web-unpublish
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes
powershell.exeto execute its management logic, which includes stopping and starting the Apache service. - [DYNAMIC_EXECUTION]: The
web-unpublish.pyscript utilizessubprocess.Popento launch the Apache executable as part of the service restart process. - [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration and server configuration files, which represent ingestion points for potentially untrusted data.
- Ingestion points: Reads
.v8-project.jsonto determine the Apache path andhttpd.confto extract publication names. - Boundary markers: None present; the script does not use specific markers to ignore embedded instructions in the configuration files.
- Capability inventory: Includes configuration file modification, recursive directory deletion, and process termination and start commands.
- Sanitization: Employs regex escaping for identification markers, but performs file path operations using extracted publication names without explicit path traversal validation.
Audit Metadata