outgoing-link-audit

Warn

Audited by Gen Agent Trust Hub on Jul 6, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes bash scripts/check_external_links.sh to perform the audit. Executing shell scripts located within the project repository allows for the execution of arbitrary commands on the host system. It also runs npm run build, which executes scripts defined in the project's configuration.
  • [EXTERNAL_DOWNLOADS]: The skill identifies and performs network requests to every external URL found in the project's generated HTML files. While the intended purpose is to verify link liveness, this involves making connections to a large number of potentially untrusted third-party servers.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (the websites being audited) and uses this information to suggest modifications to the project's source code.
  • Ingestion points: External URL responses (status codes and redirect locations) and project HTML files.
  • Boundary markers: None identified in the provided instructions for separating external data from agent commands.
  • Capability inventory: Subprocess execution (bash, npm, grep, sed), network access (fetching URLs), and file system writes (updating source pages).
  • Sanitization: There is no explicit evidence of sanitization or validation of the external content before it is used to influence the agent's reporting or file modification tasks.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 6, 2026, 04:43 PM
Security Audit — agent-trust-hub — outgoing-link-audit