defuddle
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends a global installation of the 'defuddle' package via npm ('npm install -g defuddle'). This package is provided by the skill author.
- [COMMAND_EXECUTION]: The skill operates by executing the 'defuddle' command-line tool with user-supplied URLs.
- [PROMPT_INJECTION]: The skill ingests untrusted data from the web, which introduces a vulnerability to indirect prompt injection. * Ingestion points: Web page content parsed from arbitrary URLs provided to the 'defuddle' tool. * Boundary markers: Absent. The instructions do not define delimiters or provide warnings to the agent regarding instructions that might be embedded in the fetched content. * Capability inventory: The skill uses CLI commands for setup and execution. The agent utilizing this skill likely possesses broader capabilities (network and file system access) that could be targeted by instructions found in processed data. * Sanitization: Absent. The tool is designed to remove HTML navigation and clutter for readability but does not perform safety filtering of the text content itself.
Audit Metadata