dotnet-webhint

Pass

Audited by Gen Agent Trust Hub on Apr 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill automates the installation of the hint package (webhint) from the npm registry. This is a well-known open-source tool for web quality auditing.
  • [COMMAND_EXECUTION]: The workflow utilizes standard command-line tools such as npm, npx, and rg (ripgrep) to install dependencies, run site audits, and find configuration files.
  • [PROMPT_INJECTION]: The skill processes untrusted data from external or local URLs, creating a surface for indirect prompt injection. Malicious instructions embedded in a website's HTML or headers could influence agent behavior when the audit report is interpreted. Ingestion points: Site content from audited URLs (SKILL.md). Boundary markers: Absent. Capability inventory: Command execution via npm and npx (SKILL.md). Sanitization: None mentioned.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 11, 2026, 12:41 PM
Security Audit — agent-trust-hub — dotnet-webhint