landing-page-generator-skill
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill utilizes Python scripts to audit HTML files which may contain untrusted data. This represents a potential surface for indirect prompt injection if a malicious HTML file is processed. However, the risk is mitigated as the scripts use static analysis (regex) and lack network or write permissions.
- Ingestion points: scripts/conversion_checklist.py, scripts/cta_analyzer.py, and scripts/page_speed_estimator.py read user-specified HTML files.
- Boundary markers: The scripts do not use specific boundary markers or 'ignore' instructions for the HTML content.
- Capability inventory: Scripts are limited to file reading and stdout reporting. No network operations or system-altering commands are present.
- Sanitization: No sanitization is performed on the input HTML, but analysis is restricted to specific regex patterns.
- [COMMAND_EXECUTION]: The workflow involves executing local Python scripts provided within the skill package. These scripts perform benign auditing tasks and do not execute arbitrary shell commands or user-supplied code.
- [SAFE]: The skill uses local templates and provides comprehensive reference material for design and copy frameworks. No evidence of credentials theft, obfuscated code, or persistence mechanisms was found.
Audit Metadata