render-static-sites
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill contains instructions for the agent to fetch live documentation directly from the vendor's official domain (
render.com) using tools such ascurl. This is used to ensure the agent uses current platform specifications rather than potentially outdated bundled information. - [INDIRECT_PROMPT_INJECTION]: The skill establishes a process for ingesting external documentation, which creates a potential surface for indirect prompt injection if the source content were compromised.
- Ingestion points: Documentation URLs for Render service types (specified in
references/service-types.md). - Boundary markers: Absent; the instructions do not specify using delimiters or specific warnings when reading the fetched content.
- Capability inventory: The skill uses network fetching capabilities (
curlor HTTP clients) as described in the documentation retrieval workflow inSKILL.md. - Sanitization: Absent; there is no mention of filtering or sanitizing the retrieved markdown or HTML content before processing.
Audit Metadata