landing-page-design
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the infsh CLI via Bash to perform image generation and research tasks through the Inference platform. This behavior is consistent with the skill's intended use of vendor-provided tools.
- [EXTERNAL_DOWNLOADS]: The documentation references installing additional skills using npx skills add inference-sh/skills@agent-tools. This targets the author's official repository ecosystem.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests and processes untrusted data from external web searches via Tavily and Exa. Ingestion points: Search results from infsh app run commands. Boundary markers: None present in the prompt templates. Capability inventory: Access to the Bash tool for CLI operations. Sanitization: No visible validation or filtering of external data before output.
Audit Metadata