web-traffic
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to utilize the bash tool to execute the traffic command for data retrieval and jq for processing JSON results.
- [EXTERNAL_DOWNLOADS]: The skill requires a connection to a remote MCP server at https://mcp.hedwigai.com/ and recommends installing the un-seen/hedwigai-skills plugin from the marketplace. These resources are provided by the author to enable the skill's functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-supplied domain names and URLs which are directly incorporated into shell commands.
- Ingestion points: User-provided domains and URLs (interpolated into the traffic command in SKILL.md).
- Boundary markers: No specific delimiters or safety instructions are provided to isolate user input from the shell command structure.
- Capability inventory: Use of the bash tool to execute CLI commands in the MCP environment (SKILL.md).
- Sanitization: The instructions do not include steps for sanitizing or escaping the domain strings before execution.
Audit Metadata