show-before-after
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute
python3 -m http.serverto serve the generated comparison page. This starts a network service on the local machine that serves all files within the directory where the HTML file is stored. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data to build a visual comparison, creating a potential surface for malicious content to influence the agent or the user's browser.
- Ingestion points: The skill reads "real source" code (HTML, CSS, SVG), terminal output, and logs from the environment to populate the visualization panes.
- Boundary markers: There are no specific instructions or delimiters defined to separate the untrusted data from the HTML structure of the visualization tool.
- Capability inventory: The skill has the capability to write files to the filesystem (
$TMPDIR), initiate network listeners (python3 -m http.server), and trigger browser execution. - Sanitization: The instructions do not require the agent to sanitize or escape the input data before placing it into
<iframe srcdoc>or monospace text blocks. If the source data contains malicious scripts (XSS) or instructions targeting the agent, they could be executed or processed when the page is rendered.
Audit Metadata