sitemap-generator
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill identifies and uses standard Python packages including click, requests, lxml, and beautifulsoup4, as well as an MCP server package named @clawfu/mcp-skills.
- [COMMAND_EXECUTION]: The skill provides commands for crawling websites and manipulating local files, which are executed through the main Python script provided with the skill.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface area for indirect prompt injection because it retrieves and processes content from external URLs to generate sitemaps.
- Ingestion points: External website content is retrieved using the requests.get() method in scripts/main.py.
- Boundary markers: None identified to separate crawled content from the agent's internal instructions.
- Capability inventory: The skill has the capability to perform network requests (requests.get), read local files (Path.read_text), and write to the local filesystem (ElementTree.write).
- Sanitization: The script uses BeautifulSoup to parse HTML but does not apply specific security filters or sanitization to the extracted data before it is presented to the agent.
Audit Metadata