skills/wondelai/skills/grow-website/Gen Agent Trust Hub

grow-website

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions include a fallback procedure that suggests a shell command (npx skills add wondelai/skills/<slug> --global) to the user to install missing sub-skills.
  • [EXTERNAL_DOWNLOADS]: The suggested installation command fetches code from the author's skill repository via the NPM registry.
  • [REMOTE_CODE_EXECUTION]: The fallback routine facilitates the download and execution of code packages from the author's ecosystem using the npx runner.
  • [DATA_EXFILTRATION]: The skill maintains project state by reading and writing to specific files in a local docs/ directory (e.g., WEBSITE.md, OFFER.md). This access is limited to project artifacts and research data.
  • [PROMPT_INJECTION]: The skill processes external information such as visitor research, chat logs, and surveys, which constitutes a surface for indirect instructions.
  • Ingestion points: docs/GROW-WEBSITE-PLAN.md and user-provided research data (surveys, support tickets, chat logs).
  • Boundary markers: Absent.
  • Capability inventory: Local file writing to docs/ and execution of commands via npx suggestion.
  • Sanitization: Absent.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 01:02 PM
Security Audit — agent-trust-hub — grow-website