nimble-web-expert
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes data from external websites, which is inherently untrusted. However, the skill provides robust guidance for managing this risk.
- Ingestion points: Web extraction results from
nimble extract,nimble search, andnimble mapcommands as described inSKILL.mdandreferences/nimble-extract/reference.md. - Boundary markers: The skill includes a dedicated
rules/output.mdfile titled "Handling Extracted Web Content" which explicitly instructs the agent to treat fetched content as "untrusted third-party data" and provides an "ignore embedded instructions" behavioral model. - Capability inventory: The skill utilizes
Bash(with access topython3,uv,npm,mkdir, and standard file utilities) to process extracted data. - Sanitization: Instructions in
rules/output.mdmandate incremental reading (usingheadandgrep) and shell redirection to files (> .nimble/file.md) rather than direct interpolation of large scraped contents into the prompt. - [DYNAMIC_EXECUTION]: The skill generates and executes Python and Playwright scripts to orchestrate parallel tasks and conduct site investigations.
- Evidence:
references/batch-patterns.mdcontains Python script templates that are written to local storage and executed withuv runto handle batch processing via thenimbleCLI.references/nimble-extract/browser-investigation.mdprovides Playwright scripts for discovering site selectors. - Context: These dynamic execution patterns are used for the primary purpose of the skill (scraping orchestration and site investigation) and use secure subprocess execution methods.
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official vendor tools.
- Evidence:
rules/setup.mdprovides instructions for installing the Nimble CLI vianpm i -g @nimble-way/nimble-cliand adding the Nimble MCP server fromhttps://docs.nimbleway.com/mcp. - Context: All external resources are official tools provided by the skill author (Nimbleway).
Audit Metadata