grow-website
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions include a fallback procedure that suggests a shell command (
npx skills add wondelai/skills/<slug> --global) to the user to install missing sub-skills. - [EXTERNAL_DOWNLOADS]: The suggested installation command fetches code from the author's skill repository via the NPM registry.
- [REMOTE_CODE_EXECUTION]: The fallback routine facilitates the download and execution of code packages from the author's ecosystem using the
npxrunner. - [DATA_EXFILTRATION]: The skill maintains project state by reading and writing to specific files in a local
docs/directory (e.g.,WEBSITE.md,OFFER.md). This access is limited to project artifacts and research data. - [PROMPT_INJECTION]: The skill processes external information such as visitor research, chat logs, and surveys, which constitutes a surface for indirect instructions.
- Ingestion points:
docs/GROW-WEBSITE-PLAN.mdand user-provided research data (surveys, support tickets, chat logs). - Boundary markers: Absent.
- Capability inventory: Local file writing to
docs/and execution of commands vianpxsuggestion. - Sanitization: Absent.
Audit Metadata