wix-docs
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation content, recipes, and search results from official Wix-owned domains, including dev.wix.com, wixapis.com, and mcp.wix.com.
- [COMMAND_EXECUTION]: The instructions direct the agent to use npx for executing the official @wix/cli tool. This is used for generating authentication tokens required to access certain site-specific API endpoints.
- [DYNAMIC_EXECUTION]: The skill describes an advanced search capability where the agent generates a JavaScript function to be executed by a Wix-hosted search endpoint (mcp.wix.com/api/code-mode/search). This allows for complex filtering of the API specification index within a vendor-managed sandbox.
- [INDIRECT_PROMPT_INJECTION]: By design, this skill ingests external content from documentation pages and API responses to inform the agent's actions. While this constitutes an ingestion surface for untrusted data, the skill targets official vendor sources to mitigate risks associated with untrusted third-party content.
Audit Metadata