web-design-extractor
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script (
scripts/browser-extract.mjs) to automate UI data collection. This involves spawning browser processes (Chrome, Edge, or Playwright) usingchild_process.spawn. The script uses hardcoded executable paths and randomized ports for the Chrome DevTools Protocol (CDP) session. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external websites, which serves as an ingestion point for untrusted content. As a mitigation, the extraction script (
scripts/browser-extract.mjs) truncates all extracted text from the DOM (e.g., button labels, headings) to a maximum of 46 characters before providing it to the agent, significantly reducing the attack surface for embedded instructions. - [SAFE]: The browser extraction process uses isolated temporary directories for browser user data (
mkdtempSync) and ensures the directory is removed after execution. This prevents the automated session from accessing or leaking the user's primary browser data, such as cookies, history, and stored credentials. - [SAFE]: The skill documentation includes clear guidance on 'Transcription Boundaries' and evidence labeling (
[OBSERVED],[INFERRED]), which helps users distinguish between verified architectural facts and AI-generated visual inferences.
Audit Metadata