The skill permits arbitrary JavaScript injection into live websites, enabling
Claims to do
Custom Code Management: Add, review, and manage inline custom scripts on a Webflow site — analytics, tracking pixels, chat widgets, or any custom JavaScript.
Actually does
This skill interacts with Webflow's platform using `webflow_guide_tool`, `data_sites_tool`, and `data_scripts_tool`. It lists available Webflow sites, retrieves and displays registered and applied scripts, adds new inline site-level or page-level scripts, updates page-level scripts, and deletes all site-level or page-level scripts. All operations are performed through these Webflow-specific tools.
The skill allows adding or updating arbitrary JavaScript (`sourceCode`) to a live website via `add_inline_site_script` and `upsert_page_script`. This enables client-side code execution, which can be exploited for data exfiltration, defacement, credential harvesting, or embedding malicious content for website visitors.
`add_inline_site_script` with `sourceCode`, `upsert_page_script` with `sourceCode`
The skill provides actions to `delete_all_site_scripts` and `delete_all_page_scripts`, which can remove all custom code from an entire website or a specific page. This is a high-impact destructive capability that could lead to significant disruption.
`delete_all_site_scripts`, `delete_all_page_scripts`
While explicit user confirmation (e.g., typing 'add' or 'update') is required for code changes, the human overseer is responsible for reviewing potentially complex or obfuscated JavaScript. This creates a risk of approval fatigue or social engineering if malicious code is presented subtly.
Before any mutation, present the plan and require explicit confirmation: - Adding scripts: user must type **"add"**
[](https://mondoo.com/ai-agent-security/skills/github/webflow/webflow-skills/custom-code-management)<a href="https://mondoo.com/ai-agent-security/skills/github/webflow/webflow-skills/custom-code-management"><img src="https://mondoo.com/ai-agent-security/api/badge/github/webflow/webflow-skills/custom-code-management.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/webflow/webflow-skills/custom-code-management.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.