contentsquare-web-tag-install
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the @contentsquare/wizard package from the NPM registry and may download a Chromium browser engine via Playwright if one is not detected on the system. These are vendor-owned resources and standard components required for the described tracking verification functionality.
- [COMMAND_EXECUTION]: The skill uses npx to execute the @contentsquare/wizard verify command. The process involves interpolating a tag ID provided by the user or read from a local state file. The skill includes specific instructions for the agent to validate that the ID is a lowercase hexadecimal string before use, which serves as a safeguard against command injection.
- [PROMPT_INJECTION]: The skill handles data from external sources (user input and .cs-wizard/state.json) which is used to parameterize shell commands. The risk of indirect prompt injection is mitigated by the inclusion of strict format validation rules for the agent to follow before processing the input.
Audit Metadata