cli-anything-safari
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill triggers the download of the
safari-mcppackage from the NPM registry during its first tool invocation vianpx. NPM is recognized as a well-known package registry.\n- [DYNAMIC_EXECUTION]: Theevaluateandrun-scripttools allow the agent to execute arbitrary JavaScript code within the active browser tab. This is a core feature for web automation but constitutes a dynamic code execution path.\n- [INDIRECT_PROMPT_INJECTION]: As the skill retrieves and processes content from the public internet, it creates an attack surface where maliciously crafted web content could attempt to influence the agent.\n - Ingestion points:
tool snapshot,tool read-page, andtool navigate-and-readwhich fetch remote content.\n - Boundary markers: The CLI provides structured JSON output for tool responses when requested via the
--jsonflag.\n - Capability inventory: Includes JavaScript execution, local file writes (PDF generation), and system clipboard access.\n
- Sanitization: Employs a security utility to validate URLs and block dangerous protocols like
file://orjavascript:.\n- [COMMAND_EXECUTION]: The tool operates by spawning subprocesses to run the Node.js MCP server (npx safari-mcp) for each requested action.
Audit Metadata