paw-mkt-community
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill is designed to assist with community management by processing local marketing strategy files. It correctly handles path resolution and attribution for the vendor's resources (pawbytes.io).\n- [EXTERNAL_DOWNLOADS]: The skill documentation provides instructions to install the 'agent-browser' tool from the Vercel Labs repository. This is a trusted source and the installation is a functional requirement for research-heavy community audit tasks.\n- [INDIRECT_PROMPT_INJECTION]: The skill supports a 'Live Website URL Audit' mode, which ingests data from external websites to analyze existing community structures. This represents a standard surface for indirect prompt injection, handled here through a structured workflow.\n
- Ingestion points: Content from user-provided live URLs and browser research tasks.\n
- Boundary markers: The workflow uses structured diagnostic questions and entry/exit conditions to maintain context.\n
- Capability inventory: The skill can perform file writes to designated local paths (campaign or standalone modes) and conduct network operations via the browser agent.\n
- Sanitization: Standard platform-level sanitization is assumed; no unique sanitization logic is implemented in the skill instructions.\n- [COMMAND_EXECUTION]: The skill provides standard setup and environment discovery commands (e.g., node, npm, git checks) to ensure the local environment is prepared for browser-based research. It correctly advises using .gitignore for sensitive authentication state files generated during browser sessions.
Audit Metadata