follow-builders
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: HIGHINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface as a result of fetching and processing third-party data.
- Ingestion points: In
SKILL.md, under the content delivery section, the agent ingests a combined JSON dataset produced byprepare-digest.jscontaining external text from X/Twitter posts and YouTube transcript feeds. - Boundary markers: No structural isolation or clear sandboxing delimiters are applied around the interpolated tweet texts or podcast transcripts to prevent data-to-instruction context leakage.
- Capability inventory: The agent retains local capabilities to invoke shell scripts such as
node deliver.jsor write text output to stdout. - Sanitization: No pre-ingestion text sanitization or filtering is implemented to strip potential malicious prompts from the retrieved feeds, though the skill relies on structural prompt guidelines ("绝不编造") to constrain the agent's behavior.
Recommendations
- HIGH: Downloads and executes remote code from: https://api.telegram.org/bot - DO NOT USE without thorough review
Audit Metadata