modern-web-guidance
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and run themodern-web-guidancepackage from the NPM registry. This package is maintained by a well-known organization.- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands usingnpxto perform searches and retrieve development guides.- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to command injection through unsafe interpolation of user-supplied input into shell commands. - Ingestion points: The
<query>in thesearchcommand and the<id>in theretrievecommand defined inSKILL.md. - Boundary markers: None are present in the command templates to prevent the interpretation of shell meta-characters.
- Capability inventory: The skill performs shell execution and requires outbound network access to fetch the tool.
- Sanitization: There are no instructions or mechanisms provided to validate or sanitize external input before it is used in a shell command.
Audit Metadata