web-reading
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for processing untrusted data from external URLs, which represents a potential surface for indirect prompt injection attacks where malicious instructions are hidden in web content.
- Ingestion points: The skill's primary function across all files (e.g.,
SKILL.md,SKILL.en.md) is to ingest content from arbitrary user-provided or discovered URLs. - Boundary markers: The routing logic does not explicitly define delimiters or instructions for the agent to ignore embedded prompts within the retrieved data.
- Capability inventory: The skill coordinates tools with network access and command-line capabilities, such as
web-scraperandfc_web_fetch. - Sanitization: The provided fallback Python snippet implements basic sanitization by using
BeautifulSoupto decompose potentially dangerous tags such as<script>,<style>, and<nav>before text extraction. - [SAFE]: No malicious patterns such as credential exfiltration, persistence mechanisms, or unauthorized command execution were detected. The skill's behavior is consistent with its stated purpose of managing web-reading workflows within the developer's ecosystem.
Audit Metadata