get-url
Pass
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto download and execute theplaybookspackage from the NPM registry. This is a standard method for running Node.js-based utility tools. - [COMMAND_EXECUTION]: The skill executes shell commands using
npx playbooks getto retrieve content from specified URLs. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external web pages, which represents an indirect prompt injection surface.
- Ingestion points: Content retrieved from the user-provided
<url>inSKILL.md. - Boundary markers: Not specified in the instructions.
- Capability inventory: Shell command execution via
npxused to fetch and potentially save external content. - Sanitization: No sanitization of the fetched markdown content is performed by the skill itself before being presented to the agent.
Audit Metadata