market-landing
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script to perform its core functionality.\n
- Evidence:
python3 scripts/analyze_page.py <url>is used to fetch the target landing page for analysis (SKILL.md).\n- [PROMPT_INJECTION]: The skill operates on untrusted data from external URLs, which creates a surface for indirect prompt injection attacks.\n - Ingestion points: Content from user-provided URLs is fetched and processed via the
analyze_page.pyscript (SKILL.md).\n - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the fetched content as untrusted data or to ignore potential embedded instructions.\n
- Capability inventory: The skill has the capability to execute a local subprocess (
python3) but does not appear to have network write or sensitive file access capabilities beyond the fetch operation (SKILL.md).\n - Sanitization: No sanitization or validation of the fetched HTML/content is described in the workflow instructions.
Audit Metadata