page-clone
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to ingest existing page content, analyze it, and write new content back to the document. This process creates an attack surface for indirect prompt injection if the source content (the 'model page') contains malicious instructions designed to influence the agent's behavior during the cloning process.
- Ingestion points: The agent retrieves document data using the
read_stagetool, which returns JSON structures containing user-controlled content (SKILL.md). - Boundary markers: The instructions tell the agent to 'decide, element by element, what each one is' and perform a text sweep to identify 'residue', but they do not define strict delimiters or instructions to ignore embedded commands within the processed data.
- Capability inventory: The agent possesses multiple write and modification capabilities, including
patch_stage,add_element,delete_element, andedit_deck, which could be abused if the agent is successfully injected (SKILL.md). - Sanitization: The skill notes that the runtime environment validates results and rejects 'unsafe HTML' or 'invalid' patches, providing a degree of protection against the persistence of malicious payloads (SKILL.md).
Audit Metadata