nan-extract-web-design-system
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill follows security best practices for tools that process external web content.
- The skill implements robust SSRF protection via
scripts/src/url-safety.mjs, which validates URLs and blocks navigation to private, loopback, or non-routable IP addresses unless specifically authorized by the user. - Data privacy is maintained through a thorough sanitization process in
scripts/src/capture.mjs. It redacts sensitive headers (e.g., Authorization, Cookie), query parameters containing secrets, and request bodies before saving network evidence (HAR files). - The skill includes explicit instructions for the agent to treat all captured content as untrusted evidence and to ignore any instructions found within the processed pages, mitigating risks associated with indirect prompt injection.
- Resource usage is controlled by bounding the number of elements inspected and the size of archived resources, preventing potential denial-of-service conditions during analysis.
Audit Metadata