implement-webmcp
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to expose browser DOM state and client-side actions to AI agents, which introduces a vector for untrusted external content to influence the agent's behavior.
- Ingestion points: Browser DOM context, Redux/Zustand stores, and tool inputs registered via
navigator.modelContext.provideContext(). - Boundary markers: The skill relies on manual sanitization and schema validation rules rather than explicit prompt delimiters or structural isolation to prevent instruction injection from web content.
- Capability inventory: The skill utilizes tools for file manipulation (
write_file,edit_file,create_file), shell execution (execute_command), and browser action execution (navigation, form fills). - Sanitization: The instructions mandate stripping sensitive fields (PII, tokens, HttpOnly cookies) before state synchronization and performing strict input schema validation for all tool handlers.
- [COMMAND_EXECUTION]: The development roadmap in
UPGRADE_PLAN_2026.mdinstructs the user to execute local scripts, such aspython3 core/scripts/validate-all.py, to verify the implementation.
Audit Metadata