xss-html-injection
Warn
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: MEDIUMOBFUSCATIONDYNAMIC_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [OBFUSCATION]: The skill includes Base64 encoded content designed to demonstrate how to bypass security filters. Evidence in SKILL.md: The string 'YWxlcnQoMSk=' is used within a JavaScript atob() call, which decodes to the executable command 'alert(1)'.
- [DYNAMIC_EXECUTION]: The instructions describe and provide examples of dynamic code execution techniques using dangerous JavaScript sinks. Evidence in SKILL.md: Explicit documentation of eval(), Function(), setTimeout(), and setInterval() as injection sinks. Evidence in SKILL.md: Examples using eval(atob(...)) and constructor-based execution [].constructor.constructor('alert(1)')() to run arbitrary strings as code.
- [DATA_EXFILTRATION]: The skill contains multiple payloads intended to capture and transmit sensitive information to an external server. Evidence in SKILL.md: Cookie theft payloads using document.location and fetch() targeting http://attacker.com. Evidence in SKILL.md: Keylogger implementation sending keystrokes to http://attacker.com/log via Image source requests.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies surfaces where untrusted data from external web applications enters the agent's context during vulnerability assessments. • Ingestion points: Identified in SKILL.md as search boxes, query parameters, user profiles, URL fragments, and HTTP headers like User-Agent and Referer. • Boundary markers: Includes a mandatory confirmation gate requiring the user to state the target and confirm authorization before proceeding. • Capability inventory: The skill provides templates for data exfiltration and browser-based script execution. • Sanitization: The skill focuses on detecting the absence of sanitization in targets, providing payloads specifically designed to bypass common filters.
Audit Metadata