facts-check
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the user to execute a Python script (
facts_check.py) via the terminal. These commands are intended for site auditing and reporting as described in the skill's primary purpose. - [EXTERNAL_DOWNLOADS]: The skill's script fetches content from user-provided URLs and sitemaps to perform its audit. It includes a custom fetcher that respects
robots.txtand limits download sizes to 5MB to prevent resource exhaustion. - [INDIRECT_PROMPT_INJECTION]: The skill processes live website content (HTML, metadata, JSON-LD) which could theoretically contain malicious instructions. However, the skill acts as a read-only auditor that produces a static Markdown/JSON report rather than feeding the raw data back into an LLM for autonomous action. The analysis identifies this as a low-severity surface risk inherent to web-crawling tools.
- [SAFE]: The script uses only standard Python libraries (no external dependencies) and performs read-only operations. It does not attempt to modify the target website or exfiltrate local credentials. It correctly handles redirects and respects server-side crawling policies.
Audit Metadata