flipsnack
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from an external website (flipsnack.com), creating a surface for indirect prompt injection attacks where malicious instructions in the content could influence the agent's behavior.
- Ingestion points: External data enters the agent's context through tools such as
flipsnack_com__read_page,flipsnack_com__get_templates_search,unbrowse.scrape, andunbrowse.mapas described inSKILL.md. - Boundary markers: The skill instructions do not specify the use of delimiters or "ignore embedded instructions" warnings when presenting tool output to the agent.
- Capability inventory: The skill possesses capabilities for further network requests via page reading and browser automation through the
unbrowse.browsesuite of tools. - Sanitization: There is no evidence of sanitization, filtering, or validation of the ingested external content.
- [EXTERNAL_DOWNLOADS]: The skill references and depends on external vendor resources for its core functionality.
- Evidence: The skill connects to
https://unbrowse.ai/mcp/flipsnack.comfor tool execution and referenceshttps://unbrowse.ai/api/v1/sites/flipsnack.com/openapi.jsonfor API definitions. - [REMOTE_CODE_EXECUTION]: The skill utilizes a remote Model Context Protocol (MCP) transport, which delegates tool logic and execution to a remote server.
- Evidence:
server.jsonspecifies astreamable-httpremote endpoint athttps://unbrowse.ai/mcp/flipsnack.com.
Audit Metadata