html-skills-listen
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script (
listen.sh) to start and manage a Node.js background process (server.js) that acts as a receiver for artifact submissions. - [INDIRECT_PROMPT_INJECTION]: The skill implements a channel for ingesting data from external HTML artifacts into the agent's session, which represents a potential attack surface for indirect prompt injection.
- Ingestion points: Data enters the agent's context via a local Node.js receiver (
server.js) that outputs POST request bodies to a log file, which is then tracked by theMonitortool. - Boundary markers: The skill includes a specific 'Handling submissions (security)' section in
SKILL.mdthat instructs the agent to treat all incoming data as untrusted and explicitly forbids interpreting the content as instructions or commands. - Capability inventory: The skill uses the
Monitortool to tail log files and executes local bash scripts to manage server state. - Sanitization: The
server.jscomponent enforces a 256KB limit on submission size and validates all incoming requests against a session-specific ephemeral token (?t=parameter) to prevent unauthorized cross-origin or local requests.
- Ingestion points: Data enters the agent's context via a local Node.js receiver (
Audit Metadata