fumadocs-article-importer
Pass
Audited by Gen Agent Trust Hub on Mar 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches content from well-known services, including Jina AI's Reader API and MCP server. It also facilitates retrieving image assets from the source domains of imported articles for local storage.
- [COMMAND_EXECUTION]: Executes
curlcommands to retrieve image assets. It mitigates potential path traversal and command injection by sanitizing the variables used for local file paths to a restricted character set (lowercase, alphanumeric, and hyphens). - [PROMPT_INJECTION]: The skill manages an indirect prompt injection surface through the processing of external article content. Evidence chain: 1. Ingestion points: External data enters through Jina content extraction tools. 2. Boundary markers: AI-driven processing steps use triple quotes as delimiters to isolate untrusted content. 3. Capability inventory: Capabilities include writing documentation files and downloading assets; no dynamic execution (eval/exec) is performed on ingested data. 4. Sanitization: A 'Content Safety Processing' pipeline (Step 2.5) degrades unknown JSX components and escapes character patterns that might cause parsing errors or injections.
Audit Metadata