drupal-project-description
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
curlto fetch project page content fromdrupal.org. This is a well-known service, and the download is used solely for extracting existing description text to facilitate editing. - [COMMAND_EXECUTION]: Employs standard shell commands to download data and write HTML files to the local project directory. These actions are consistent with the skill's stated purpose of managing project documentation.
- [PROMPT_INJECTION]: The skill processes data from external web pages, which introduces a surface for indirect prompt injection.
- Ingestion points: Content downloaded from
drupal.org/project/into a localpage.htmlfile. - Boundary markers: No explicit delimiters are used to separate the external content from system instructions during processing.
- Capability inventory: Shell command execution for data retrieval, file system write access, and potential browser-based screenshot functionality.
- Sanitization: Output is limited to a strict whitelist of HTML tags and specific CSS classes allowed by the Drupal.org platform.
Audit Metadata