optise-helix-fitq-audit
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local Python script (
scripts/fetch_page.py) for webpage analysis. This script is well-hardened, utilizing only standard libraries and performing strict validation on input arguments to prevent command injection. - [DATA_EXFILTRATION]: While the skill performs network requests to fetch user-provided URLs, it implements comprehensive security measures to prevent Server-Side Request Forgery (SSRF). The
scripts/fetch_page.pyutility resolves hostnames, verifies that the resulting IPs are public, and pins the connection to the verified IP to prevent DNS rebinding. These checks are applied consistently to the initial URL and all subsequent redirect hops. - [INDIRECT_PROMPT_INJECTION]: The skill addresses the risk of processing untrusted external content through its 'Operating Principles' (
references/operating-principles.md). It explicitly instructs the agent to treat all fetched content as data and never follow instructions contained within that content. - [SAFE]: The skill follows professional security and reliability practices, including session hygiene checks, mandatory source tiering, and a requirement for a verification log to ensure the transparency and accuracy of the AI's findings.
Audit Metadata