scrape-review-schema
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were identified. The skill follows expected practices for local web-based review tools.
- [COMMAND_EXECUTION]: The skill uses local shell commands (including
mktemp,cp, anduv run) to prepare a temporary review directory and launch a local feedback server. These operations are restricted to the local environment and are essential for the skill's functionality. - [DATA_EXFILTRATION]: User feedback is captured via a one-shot HTTP server. This server is configured to bind exclusively to
127.0.0.1, ensuring that data does not leave the local machine during the review process. - [PROMPT_INJECTION]: The skill displays content extracted from external sources in a dashboard. It mitigates indirect prompt injection risks by applying HTML escaping to all dynamic text in the UI and rendering potentially untrusted HTML pages within a sandboxed iframe.
Audit Metadata