extract-annotation-source
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by ingesting untrusted data from external URLs.
- Ingestion points: Data is extracted from the
window.__AXHUB_ANNOTATION_SOURCE__object on arbitrary web pages via browser automation tools like Playwright. - Boundary markers: The instructions do not specify any delimiters or warnings to prevent the agent from following instructions embedded within the extracted
annotationTextoraiPromptfields. - Capability inventory: The skill possesses the capability to navigate to any URL and execute JavaScript on the page using standard browser automation tools.
- Sanitization: There is no evidence of sanitization or filtering of the retrieved content, allowing potentially malicious instructions to be passed directly into the agent's context.
Audit Metadata