css-first
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches live web platform compatibility data from
api.webstatus.devand documentation fromdeveloper.mozilla.org. These are well-known, official sources for web development information. - [INDIRECT_PROMPT_INJECTION]: The skill includes instructions to ingest data from external APIs. However, it explicitly mitigates this risk by instructing the agent to treat fetched data solely as data, validate its schema, and never interpret it as instructions.
- [COMMAND_EXECUTION]: The skill includes a Python script (
scripts/update_baseline.py) designed to refresh local compatibility snapshots by fetching data from the official WebStatus API and updating project files via regex. The script uses standard libraries and targeted, verified endpoints.
Audit Metadata