knowledge-site-creator
Fail
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: CRITICALDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill employs 'node -e' with 'eval()' to process the 'wordData.js' file during a validation step in SKILL.md. This allows for the execution of any JavaScript code that the AI generates within that file based on user-provided topics.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts a user-provided 'topic' to drive the website content generation. There is a potential for malicious input to influence the AI's generation process, although the skill includes explicit guidelines in 'references/code-quality.md' to prevent XSS in the final output.
- [COMMAND_EXECUTION]: The skill uses shell commands for project initialization, file writing, Git operations, and deployment via the Vercel CLI. These actions are within the scope of the skill's primary purpose as a site creator and deployment tool.
- [DATA_EXFILTRATION]: Automated scanners flagged the URL 'your-site.vercel.app'. Technical analysis indicates this is a documentation placeholder used in example SEO scripts and verification logic, rather than a malicious exfiltration point.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata