registry-browser
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches metadata and the full content of
SKILL.mdfiles from remote GitHub repositories and arbitrary URLs provided by the user. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and displays untrusted content from external registries.
- Ingestion points: Fetches frontmatter (name and description) and full
SKILL.mdbodies from remote repositories and user-supplied URLs inSKILL.md(Workflow Steps 1, 4, and 5). - Boundary markers: No specific delimiters or warnings are used to isolate the fetched external text from the agent's internal instructions.
- Capability inventory: Performs network requests to fetch data and reads/writes to the local filesystem (
~/.claude/plugins/config/...andreferences/registry-cache.json). - Sanitization: There is no evidence of sanitization, filtering, or validation performed on the external markdown or metadata before it is processed and displayed.
- [DATA_EXFILTRATION]: The skill performs network operations to external, non-whitelisted domains when users provide custom registry URLs for verification and monitoring.
Audit Metadata