site-launch-kit

Warn

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill performs a silent global installation of the nano-banana MCP server via npx -y @zhibinyang/nano-banana-mcp. This involves downloading and executing code from an untrusted third-party npm package.
  • [EXTERNAL_DOWNLOADS]: The skill installs the agent-browser utility globally and triggers a secondary download of a dedicated browser binary (~300MB). It also fetches numerous project dependencies from npm during the cloning and build processes.
  • [PROMPT_INJECTION]: The skill processes untrusted content from user-provided URLs using browser automation without sanitization or boundary markers, creating a surface for indirect prompt injection.
  • Ingestion points: agent-browser open in references/02-clone.md used to visit arbitrary sites.
  • Boundary markers: Absent during data extraction.
  • Capability inventory: Shell command execution (npm, npx), local file system access (.env, design-system/), and network-based deployment (vercel).
  • Sanitization: Absent; extracted HTML structure and computed CSS values are used directly to generate React components.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 26, 2026, 08:56 PM
Security Audit — agent-trust-hub — site-launch-kit