post-launch

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill crawls and processes data from external websites (production, staging, and legacy hosts) to perform SEO and configuration audits. This creates a surface where malicious instructions embedded in a crawled site could attempt to influence the agent's interpretation of the audit results.
  • Ingestion points: scripts/lib/cutover.mjs fetches content from production, staging, and old host URLs provided as command-line arguments.
  • Boundary markers: The skill does not utilize explicit delimiters or 'ignore' instructions when interpolating the content of crawled web pages into its processing logic.
  • Capability inventory: The skill performs network GET requests and writes report bundles and state files (watch.json) to the local filesystem.
  • Sanitization: The skill performs basic URL normalization and hostname slugification but processes page bodies for analytics and metadata tags.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute Node.js scripts (scripts/post-launch.mjs) to perform auditing tasks. These scripts utilize relative path imports (e.g., ../../../launch-audit/) to access logic in a sibling directory, indicating a structural dependency on a separate auditing framework.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to audit user-provided URLs and verifies DNS propagation by querying well-known public resolvers (Google, Cloudflare, Quad9, and OpenDNS). These DNS services are established and trusted for this purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 09:38 PM