Skills
Navigate
skills/codetesla51/skills/defuddle/Gen Agent Trust Hub

defuddle

Warn

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install an external package 'defuddle' globally from the npm registry. This package is not from a pre-verified trusted organization.
  • [COMMAND_EXECUTION]: The skill relies on the execution of the defuddle CLI tool to parse web content based on user-provided URLs.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from remote web pages, which could contain malicious instructions designed to influence the agent's behavior.
  • Ingestion points: Content fetched from remote web pages via the <url> argument in SKILL.md.
  • Boundary markers: The skill does not define specific delimiters or instructions to treat the fetched content as untrusted data.
  • Capability inventory: The skill can execute the defuddle command and write output to the local file system using the -o flag as described in SKILL.md.
  • Sanitization: No evidence of sanitization, filtering, or validation of the fetched HTML or converted Markdown content is provided.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 17, 2026, 04:40 PM