defuddle
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the
defuddlepackage via the npm package manager. This is a utility provided by the skill author for parsing web content. \n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external web pages, creating a vulnerability surface for indirect prompt injection. \n - Ingestion points: Web content retrieved via
defuddle parse <url>inSKILL.md. \n - Boundary markers: None specified in the instructions. \n
- Capability inventory: Network access for fetching URLs and file system writing using the
-oflag inSKILL.md. \n - Sanitization: The tool cleans HTML to markdown, which removes script tags but does not filter natural language instructions.
Audit Metadata