skills/rheinmir/setup/extract-site/Gen Agent Trust Hub

extract-site

Pass

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes data from untrusted external websites, creating a surface for indirect prompt injection where malicious content on a site could attempt to influence the agent's behavior during the design extraction process.
  • Ingestion points: Untrusted data enters the agent's context when it fetches and inspects content from external URLs provided in the command arguments (e.g., the URL parameter in the extract or rico commands defined in SKILL.md).
  • Boundary markers: Absent. The skill instructions do not define explicit delimiters or use specific isolation prompts to prevent the agent from obeying instructions that might be embedded in a website's CSS, HTML comments, or metadata.
  • Capability inventory: The skill enables the agent to write multiple files (Markdown, HTML, JSON, CSS) to the local filesystem within the themes/ and llmwiki/ directories.
  • Sanitization: There is no mention of validation or sanitization procedures for the data retrieved from external URLs before it is parsed and used to generate the design system artifacts.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 27, 2026, 05:55 AM
Security Audit — agent-trust-hub — extract-site