improve-existing-website
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data from rendered websites or source code, creating a surface for indirect prompt injection where malicious content in the site could attempt to influence the agent's analysis.
- Ingestion points: The skill requires access to a "Rendered site or source files" (defined in
contract.json) and instructs the agent to "Open the real site" for inspection (references/audit-procedure.md). - Boundary markers: The skill provides a defensive structure by requiring the agent to strictly label observations as EVIDENCE and derivations as INFERRED (
SKILL.md,references/inspection-state-machine.md), which helps mitigate accidental obedience to embedded instructions. - Capability inventory: The agent generates design reports and performs "scoped repairs" (
SKILL.md), which involves writing to the filesystem based on its analysis of the external data. - Sanitization: There are no explicit instructions for sanitizing or filtering HTML, CSS, or other website source code before it is processed by the agent.
- [NO_CODE]: The skill contains no executable scripts (e.g., Python, JavaScript, Shell) or binary files. It consists entirely of Markdown documentation, templates, and a JSON configuration file, significantly reducing the risk of direct malicious code execution.
Audit Metadata