web-extension-reverse
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data, specifically browser extension packages (.crx, .xpi) and their source code. This creates a potential surface for indirect prompt injection where malicious instructions embedded in the analyzed extension could attempt to influence the agent's behavior.
- Ingestion points: The skill processes external manifest.json files, background scripts, and content scripts (SKILL.md steps 1-4).
- Boundary markers: The skill explicitly recommends using an isolated VM for malicious samples, which acts as a process-level safety boundary.
- Capability inventory: The skill utilizes tools like jq, unzip, and yara to interact with and process the external data.
- Sanitization: No specific input sanitization is mentioned; the skill relies on the analyst to interpret the code safely within an isolated environment.
Audit Metadata