site-launch-kit
Warn
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill performs a silent global installation of the
nano-bananaMCP server vianpx -y @zhibinyang/nano-banana-mcp. This involves downloading and executing code from an untrusted third-party npm package. - [EXTERNAL_DOWNLOADS]: The skill installs the
agent-browserutility globally and triggers a secondary download of a dedicated browser binary (~300MB). It also fetches numerous project dependencies from npm during the cloning and build processes. - [PROMPT_INJECTION]: The skill processes untrusted content from user-provided URLs using browser automation without sanitization or boundary markers, creating a surface for indirect prompt injection.
- Ingestion points:
agent-browser openinreferences/02-clone.mdused to visit arbitrary sites. - Boundary markers: Absent during data extraction.
- Capability inventory: Shell command execution (
npm,npx), local file system access (.env,design-system/), and network-based deployment (vercel). - Sanitization: Absent; extracted HTML structure and computed CSS values are used directly to generate React components.
Audit Metadata