extract-annotation-source

Pass

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting untrusted data from external URLs.
  • Ingestion points: Data is extracted from the window.__AXHUB_ANNOTATION_SOURCE__ object on arbitrary web pages via browser automation tools like Playwright.
  • Boundary markers: The instructions do not specify any delimiters or warnings to prevent the agent from following instructions embedded within the extracted annotationText or aiPrompt fields.
  • Capability inventory: The skill possesses the capability to navigate to any URL and execute JavaScript on the page using standard browser automation tools.
  • Sanitization: There is no evidence of sanitization or filtering of the retrieved content, allowing potentially malicious instructions to be passed directly into the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 20, 2026, 02:44 AM
Security Audit — agent-trust-hub — extract-annotation-source