info-card-designer
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it is designed to visit and extract content from arbitrary URLs provided by the user.
- Ingestion points: External web content retrieved via the Chrome DevTools MCP during the card generation workflow (SKILL.md).
- Boundary markers: The instructions do not define strict delimiters (like XML tags) or provide "ignore embedded instructions" warnings when processing external data.
- Capability inventory: File writing to local directories (~/乔木新知识库/...), browser navigation, and execution of local Python scripts.
- Sanitization: No explicit sanitization or filtering of scraped content is defined before the agent processes it into HTML layout templates.
- [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/split_card.pyto handle image processing. - The execution occurs in Step 4 of the SKILL.md workflow.
- While the script uses standard libraries (Pillow) and performs simple cropping, the capability to execute scripts with arguments derived from the generation process is a noted security surface.
Audit Metadata