scrape-codegen-analyze
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted HTML data to generate analysis for a downstream agent. Malicious instructions hidden in HTML elements, JSON-LD, or scripts could influence the agent's behavior.
- Ingestion points: Raw HTML file (
page_html_path) and metadata. - Boundary markers: None. Untrusted content is processed without delimiters or 'ignore' instructions.
- Capability inventory: Access to
Bash(shell execution),Read, andWritetools. - Sanitization: None. The skill explicitly preserves scripts during cleaning, which may contain malicious payloads.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (
mkdir,uv run) using variables derived from the$ARGUMENTSstring. This creates a surface for command injection if the arguments (such aswork_path) contain shell metacharacters. - [DATA_EXPOSURE]: The skill accesses files outside its immediate directory (e.g.,
../scrape/references/python-environments.md), which relies on the agent having broad read permissions across the workspace.
Audit Metadata