contentful-personalization
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting untrusted data from the user's local codebase (via the
gather-contextstep) and inspecting external live URLs (via thelive-debugsub-skill). While this is necessary for its stated purpose of diagnosing and implementing personalization, it creates a surface for indirect instructions to influence agent behavior. - Ingestion points: Codebase exploration and live URL inspection using Chrome DevTools.
- Boundary markers: The skill uses a structured XML-tagged interaction model (e.g.,
<system>,<prompt>,<ask-user>) to separate behavioral directives from data. - Capability inventory: The skill executes a custom Node.js binary (
scripts/run) and utilizes MCP tools for browser interaction and file reading. - Sanitization: There is no explicit documentation of sanitization or filtering for the content ingested from the codebase or external URLs.
Audit Metadata