extract-llms-txt
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes content from arbitrary documentation URLs, which serves as a vector for indirect prompt injection.
- Ingestion points: The agent fetches content from user-provided URLs and recursively discovers additional pages through crawling, sitemaps, and existing llms.txt indices as described in the 'Search for an official index first' and 'Crawl the boundary by hand' sections of SKILL.md.
- Boundary markers: There are no explicit instructions for the agent to sanitize or escape the content fetched from external sites before processing it or writing it to the local filesystem.
- Capability inventory: The skill utilizes the agent's capability to perform network requests to external sites and write files to the local repository (specifically creating index files in 'docs/llms/' and potentially modifying project configuration files).
- Sanitization: The skill lacks sanitization routines for the data it extracts (titles, descriptions); it explicitly instructs the agent to 'Prefer the description already given by the site', which increases the risk of adopting malicious payloads embedded in the source documentation metadata.
Audit Metadata