extract-site
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user-provided URLs to extract design tokens and component specifications.
- Ingestion points: Data is gathered from public websites using screenshots and CSS/DOM inspection as described in the SKILL.md workflow (W02).
- Boundary markers: The skill lacks explicit instructions to ignore potentially malicious instructions embedded in a target website's text, metadata, or code.
- Capability inventory: The agent writes files to the themes/ and llmwiki/wiki/ directories.
- Sanitization: There is no evidence of sanitization for the content extracted from target websites before processing.
- [DYNAMIC_EXECUTION]: The skill utilizes local JavaScript assets (enumerate-assets.js, extract-component-styles.js) executed via browser evaluation tools to programmatically extract DOM hierarchy and computed styles.
- [PERSISTENCE]: The skill automatically updates the llmwiki/wiki/index.md and llmwiki/wiki/log.md files after each execution to maintain a record of its activities, which is a standard persistence mechanism for the environment.
Audit Metadata