wix-docs
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to official Wix-owned domains including
dev.wix.com,wixapis.com, andmcp.wix.comto fetch documentation and API specifications. These are verified vendor resources. - [COMMAND_EXECUTION]: The skill provides instructions for using standard command-line utilities such as
curlfor data retrieval and the Wix CLI (npx @wix/cli@latest) for generating authentication tokens, which are expected tools for interacting with the Wix platform. - [DYNAMIC_EXECUTION]: The skill utilizes the Wix 'code-mode' API endpoint (
https://mcp.wix.com/api/code-mode/search) to execute JavaScript functions server-side for structured searching of the API index. This is a documented feature of the vendor's documentation service. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external documentation content, which presents a standard attack surface for indirect prompt injection. 1. Ingestion points: Markdown and JSON content from Wix documentation servers. 2. Boundary markers: The skill encourages using
jqorawkto extract specific portions of data, though it does not mandate specific delimiters for the LLM. 3. Capability inventory: The skill uses network operations (curl) and CLI execution (npx). 4. Sanitization: Content is processed directly as it is retrieved from official vendor sources.
Audit Metadata