ui-json-capture
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The
SKILL.mdfile uses the dynamic context syntax (!skill-toc) to execute a local utility that generates a table of contents at skill load time. This is a standard organizational tool and does not perform malicious actions. - [COMMAND_EXECUTION]: The skill utilizes a local Python script (
scripts/assemble.py) to process and verify the integrity of captured data batches. This script is executed via a standard shell command. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest volumes of untrusted JSON data from external research platforms, creating a potential surface for indirect prompt injection.
- Ingestion points: Network request responses (XHR/fetch) from third-party research UIs are captured by the
scripts/01-install-hook.jsscript. - Boundary markers: The skill contains explicit instructions directing the agent to use the
filePathparameter to write data to disk, preventing the untrusted content from entering the model's active context window. - Capability inventory: The skill possesses capabilities for browser automation via CDP, local file system writes, and shell execution of the assembly script.
- Sanitization: Captured data is aggregated and validated by
scripts/assemble.pyusing standard JSON libraries before being written to a final JSONL file.
Audit Metadata