ads-dna
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites, creating a surface for indirect prompt injection attacks.\n
- Ingestion points: External content is retrieved using the WebFetch tool in Step 2 from user-supplied URLs.\n
- Boundary markers: The instructions do not define delimiters or explicit boundary markers to prevent the agent from following instructions embedded in the scanned web content.\n
- Capability inventory: The skill has permissions to write to the local filesystem (brand-profile.json) and execute shell-based commands (python script).\n
- Sanitization: There are no directions to sanitize or filter the fetched content before the agent analyzes it.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command incorporating raw user input.\n
- The instruction
python ~/.claude/skills/ads/scripts/capture_screenshot.py [url]in Step 2b interpolates the user-provided[url]directly into a command line. This represents a potential command injection vector if the input is not properly escaped by the agent or the script.
Audit Metadata