defuddle

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions include installing the defuddle package from the NPM registry via npm install -g defuddle. This package is authored by the skill developer.
  • [COMMAND_EXECUTION]: The skill utilizes the defuddle command-line interface to parse external URLs and includes options for writing output to the local file system (e.g., defuddle parse <url> --md -o content.md).
  • [INDIRECT_PROMPT_INJECTION]: As the skill is designed to fetch and process content from arbitrary web pages, it possesses an inherent surface for indirect prompt injection where instructions on a parsed page could attempt to influence the agent's behavior.
  • Ingestion points: SKILL.md (via the defuddle parse <url> command).
  • Boundary markers: None specified in the instructions.
  • Capability inventory: Command execution and file system write capabilities.
  • Sanitization: No sanitization or filtering of the parsed content is described in the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 09:58 PM