download-webpage-as-pdf
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
agent-browser,pdfinfo,qpdf, andghostscript. These tools are utilized for browser automation and PDF processing as per the skill's primary function. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
agent-browserNode.js package and suggests the use ofnpx percollate. These tools are sourced from official registries and the author's official repository. - [PROMPT_INJECTION]: The skill processes content from arbitrary URLs provided by the user, which presents a surface for indirect prompt injection.
- Ingestion points: User-supplied
<URL>passed toagent-browser openinSKILL.md. - Boundary markers: None identified.
- Capability inventory: JavaScript execution within the browser context via
agent-browser eval, file writing capability for PDF generation, and shell command execution for post-processing. - Sanitization: None performed on the external URL or the retrieved page content.
Audit Metadata