canai-replicate
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a specialized CLI tool ('bin/replica') and instructs the agent to utilize the 'agent-browser' utility. These tools are used solely for orchestrating the discovery of pages, extracting content and design tokens, and validating the fidelity of the generated output.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted web content from live sites, creating an indirect prompt injection attack surface.
- Ingestion points: Site data enters the agent context through the discovery phase ('src/discover.mjs'), classification ('src/classify.mjs'), and the content extraction payloads executed via browser automation ('src/captureBundle.mjs').
- Boundary markers: High-fidelity prompts in the 'prompts/' directory enforce strict structural separation between external content and instructions, using directives like 'USE THIS COPY VERBATIM' to guide the agent.
- Capability inventory: The skill relies on 'Bash' for CLI execution, 'Read'/'Write' for artifact management, and Node.js 'fetch' for network-based site discovery.
- Sanitization: The 'src/pushprep.mjs' module acts as a sanitization layer, mechanically stripping local preview libraries and structural HTML tags from ingested content before deployment.
Audit Metadata