ads-dna
Warn
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command (
python ~/.claude/skills/ads/scripts/capture_screenshot.py [url]) using a user-provided URL as a direct argument. This creates a command injection vulnerability if the URL contains shell metacharacters (e.g.,;,&,|). - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it fetches and processes untrusted text and HTML content from arbitrary external websites (Step 2). There are no boundary markers or instructions to the agent to ignore potentially malicious instructions embedded in the fetched site content.
- Ingestion points: Content retrieved from external URLs using the WebFetch tool in SKILL.md Step 2.
- Boundary markers: Absent; the skill does not use delimiters or warnings to separate external data from agent instructions.
- Capability inventory: Execution of a Python script via shell (Step 2b) and local file write access for
brand-profile.json(Step 5). - Sanitization: Absent; the skill does not include steps to sanitize or validate the content fetched from external URLs before it is processed by the agent.
Audit Metadata