landing
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates Node.js scripts (_landing_screenshot.mjs and _landing_audit.mjs) from internal templates and executes them locally to perform browser-based auditing. While the templates are static, this pattern involves runtime script generation and execution.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the project environment which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: The skill reads DESIGN-BRIEF.md and scans landing page source files (.tsx, .html). It also extracts data from the browser DOM using page.evaluate in the generated audit scripts.
- Boundary markers: No delimiters or safety instructions are used when ingesting external project data.
- Capability inventory: The agent can execute shell commands (curl, find, grep, node), write files to the project directory, and interact with the local development environment.
- Sanitization: There is no evidence of sanitization or filtering of the content read from external files or the DOM.
- [COMMAND_EXECUTION]: The skill uses curl to verify the state of the local development server and employs find and grep to locate specific components and identify unoptimized assets within the codebase.
Audit Metadata