portaljs-add-resource
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to fetch and follow a workflow from a remote vendor-associated GitHub repository. This effectively imports instructional logic from a remote source.\n- [EXTERNAL_DOWNLOADS]: The skill uses
curlandWebFetchto download resources from external URLs provided as inputs, which are then stored in the portal's public data directory.\n- [COMMAND_EXECUTION]: The skill executes shell commands such asnpx next buildfor site verification andmkdir/cpfor managing the project's file structure.\n- [PROMPT_INJECTION]: The skill processes untrusted data from external URLs or local files, presenting a surface for indirect prompt injection.\n - Ingestion points: Resource data fetched from URLs or read from local paths specified in the
SOURCEparameter.\n - Boundary markers: There are no explicit delimiters or safety instructions implemented to prevent the agent from being influenced by content within the fetched resource files.\n
- Capability inventory: The skill has permissions to write to the file system, execute build commands, and perform network requests.\n
- Sanitization: Validation is limited to HTTP status and file format detection; no deep content sanitization is performed on the data being added to the portal.
Audit Metadata