external-linking
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local script
scripts/report_publish.pyto generate final HTML and PDF reports from the markdown analysis. - [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection as it fetches and interprets content from external websites.
- Ingestion points: The skill performs
webfetchoperations on URLs provided by the user and all external links found on those pages. - Boundary markers: No delimiters or safety instructions are defined to separate untrusted external content from the agent's internal logic.
- Capability inventory: The skill utilizes network access via
webfetchand local command execution viapython. - Sanitization: The instructions do not include steps to sanitize or validate the content retrieved from external sources.
Audit Metadata