ui-cloner

Pass

Audited by Gen Agent Trust Hub on Apr 2, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: Indirect Prompt Injection Risk. The skill ingests untrusted content from external websites during the Site DNA Extraction phase. This content is then processed to create a build specification. * Ingestion points: Raw HTML, CSS, and metadata from user-provided URLs in references/phase1-site-dna.md. * Boundary markers: Absent. The skill does not instruct the agent to ignore or isolate instructions found within the processed website data. * Capability inventory: File system access for creating the workspace (./ui-clone-workspace/), browser control for site analysis, and the ability to generate and potentially execute a build prompt in references/phase4-build.md. * Sanitization: Absent. No validation or sanitization is performed on the extracted text or data before it is used to generate the build prompt.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to include scripts from well-known CDNs (Cloudflare, Unpkg, JSDelivr) for libraries such as GSAP, Tailwind, and Lottie. These are standard web development resources originating from well-known infrastructure and are documented neutrally.
  • [COMMAND_EXECUTION]: During the build phase (Phase 4), the agent is encouraged to execute a generated prompt to create the website. This introduces a risk if the prompt has been poisoned by the source website, potentially leading to the creation of malicious files or logic within the local workspace.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 2, 2026, 10:59 AM