web-capture
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external websites to update the repository knowledge base.\n
- Ingestion points: Content is fetched from URLs defined in DOMAIN, PAGES, and COMPETITORS using the parallel orchestration tools and stored in cadence/log/raw/web/ files (found in infra/agents/web-scribe.prompt.ts).\n
- Boundary markers: The agent's prompt lacks explicit markers or instructions to isolate or ignore potential commands embedded within the fetched web content.\n
- Capability inventory: The agent utilizes the claudeCode harness, providing access to the file system, git operations (commit, branch, PR), and shell execution (infra/agents/web-scribe.ts).\n
- Sanitization: Web content is written to disk via a basic Node.js script and subsequently read by the agent without sanitization or filtering.\n- [DYNAMIC_EXECUTION]: The skill executes node -e scripts that are embedded as strings within the system prompt to handle file writing from tool outputs (infra/agents/web-scribe.prompt.ts).\n- [COMMAND_EXECUTION]: The agent is instructed to execute several shell commands including git, npm run lint:context, and cargo-ai CLI operations to manage the workflow and retrieve external data.
Audit Metadata