ai-visibility-fix-plan
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The README.md file contains installation instructions directing users to run
npx skills add unifapi-agent/agents. This process downloads and executes packages from the developer's official repository. - [COMMAND_EXECUTION]: The skill documentation includes shell commands and plugin installation directives (
npx,/plugin) intended for setting up the environment. These commands are tied to the vendor's infrastructure and the skill's stated purpose. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it utilizes tools like
browser/markdownandgeo/serpto retrieve and process content from external, third-party websites. - Ingestion points: External website content via
browser/markdownand search engine results viageo/serp(defined in SKILL.md). - Boundary markers: The instructions do not specify explicit delimiters or 'ignore' instructions for the processed external data.
- Capability inventory: No dangerous capabilities (such as file system writes, subprocess execution, or arbitrary network requests) are present in the skill's instructions.
- Sanitization: There are no explicit sanitization or filtering steps defined for the ingested data, though the skill's output is limited to a structured report.
Audit Metadata