agent-use
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
web_agent_readiness.pyscript performs network requests using the standard library to verify the availability of agent-readiness endpoints such asllms.txtand OpenAPI specifications on target domains. This behavior is documented and necessary for the tool's core functionality. - [COMMAND_EXECUTION]: The
validate_skill.pyscript invokes the Python interpreter viasubprocess.callto execute other scripts in the package with a--helpflag. This is done solely for validation purposes to ensure scripts are properly documented for agent use. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data from file systems and websites. While this creates an attack surface, the skill is specifically an audit tool and includes detailed references on security best practices, such as
references/security-recovery.md, which advises on separating untrusted data from instructions and using human-in-the-loop approvals. - [DYNAMIC_EXECUTION]: The validation tools utilize
py_compile.compileto check script syntax within the skill directory. This is a standard development practice and is restricted to the local skill files during the validation workflow.
Audit Metadata