scrape-codegen
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect prompt injection surface detected where untrusted external data is processed.
- Ingestion points: The skill reads
spec.json, HTML snapshots (raw.html,rendered.html), and expected values from the user-providedspec_pathinSKILL.mdandscripts/convert_fixtures.py. - Boundary markers: No explicit markers or "ignore embedded instructions" warnings are used when passing the extracted data to sub-agents during the
/scrape-codegen-analyzeand/scrape-codegen-generatesteps. - Capability inventory: The skill has access to
Bash,Write, andReadtools, and executes shell commands for code generation and testing. - Sanitization: Input HTML and JSON content is read directly from files without sanitization or validation before being used for code generation.
- [COMMAND_EXECUTION]: The skill executes
uv run pyteston Python code that it has dynamically generated. This creates a risk where malicious code injected via the indirect prompt injection surface could be executed with the permissions of the agent during the testing phase.
Audit Metadata