html-upload
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches HTML content from user-supplied postplan.dev URLs using curl and instructs the agent to treat this content as an artifact to continue a task. This creates a surface where malicious instructions embedded within the fetched HTML could potentially influence the agent's behavior.
- Ingestion points: Data enters the agent's context when it reads /tmp/postplan.html, which was populated via a curl request to a user-provided URL in SKILL.md.
- Boundary markers: The instructions do not specify any delimiters or safety markers to wrap the fetched content, nor do they instruct the agent to ignore instructions embedded within the downloaded file.
- Capability inventory: The skill has the capability to execute shell commands (curl, npx), read local files, and upload local files to the Postplan service.
- Sanitization: The skill does not perform any sanitization or validation on the fetched HTML before the agent processes it.
- [COMMAND_EXECUTION]: The skill uses shell commands to perform its core functions, specifically invoking 'npx postplan' to upload files and 'curl' to retrieve content from external URLs.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to download content from the postplan.dev domain and uses 'npx' to execute the postplan package from the npm registry.
Audit Metadata