webflow-migration-deep-dive

Pass

Audited by Gen Agent Trust Hub on Mar 25, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes untrusted content from external APIs (WordPress) and local files (CSV), creating an indirect prompt injection surface.\n
  • Ingestion points: External data is ingested via the fetchWordPressPosts function using the fetch API and importFromCSV using readFileSync.\n
  • Boundary markers: No specific boundary markers or 'ignore embedded instructions' directives are implemented to separate ingested data from the agent's internal logic.\n
  • Capability inventory: The skill utilizes Bash, Write, Edit, and Read tools, providing the agent with the ability to execute code and modify the filesystem based on processed data.\n
  • Sanitization: While the skill includes a slugify utility for URL paths, higher-risk fields like title and content (HTML) are mapped directly to the target system without filtering for potential malicious instructions.\n- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute local scripts using npx tsx, which involves running TypeScript code within the shell environment via the Bash tool.\n- [DATA_EXFILTRATION]: The skill performs network operations to fetch content from user-provided URLs (WordPress REST API) and interacts with the Webflow API using a sensitive WEBFLOW_API_TOKEN retrieved from the environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 25, 2026, 04:42 PM