skills/wix/skills/wix-docs/Gen Agent Trust Hub

wix-docs

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill performs network requests to official Wix-owned domains including dev.wix.com, wixapis.com, and mcp.wix.com to fetch documentation and API specifications. These are verified vendor resources.
  • [COMMAND_EXECUTION]: The skill provides instructions for using standard command-line utilities such as curl for data retrieval and the Wix CLI (npx @wix/cli@latest) for generating authentication tokens, which are expected tools for interacting with the Wix platform.
  • [DYNAMIC_EXECUTION]: The skill utilizes the Wix 'code-mode' API endpoint (https://mcp.wix.com/api/code-mode/search) to execute JavaScript functions server-side for structured searching of the API index. This is a documented feature of the vendor's documentation service.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external documentation content, which presents a standard attack surface for indirect prompt injection. 1. Ingestion points: Markdown and JSON content from Wix documentation servers. 2. Boundary markers: The skill encourages using jq or awk to extract specific portions of data, though it does not mandate specific delimiters for the LLM. 3. Capability inventory: The skill uses network operations (curl) and CLI execution (npx). 4. Sanitization: Content is processed directly as it is retrieved from official vendor sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 01:51 PM
Security Audit — agent-trust-hub — wix-docs