webflow-debug-bundle
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local project files and application logs, creating a potential surface for indirect prompt injection.
- Ingestion points: The skill inventories package manifests, webflow.json, and recent application logs as defined in the Workflow section of SKILL.md.
- Boundary markers: While the skill provides instructions to redact secrets, it lacks specific boundary markers or delimiters to isolate untrusted content from the agent's core instructions.
- Capability inventory: The skill uses Write and Edit tools to generate the final debug bundle.
- Sanitization: The instructions explicitly require redacting tokens, secrets, and personal data, and performing a final review before packaging.
- [EXTERNAL_DOWNLOADS]: The skill fetches configuration and documentation from official Webflow developer resources.
- Evidence: References to developers.webflow.com and status.webflow.com are included in SKILL.md and references/official-docs.md.
Audit Metadata