content-brief
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted content from the open web as part of its primary workflow. While this is necessary for its intended purpose, it creates a surface where an attacker could influence the agent's behavior via content found in search results.
- Ingestion points: The agent is instructed to "Google the target keyword" and "Read the top 10 results" in
SKILL.md, bringing external, untrusted content into the agent's context. - Boundary markers: There are no explicit instructions or delimiters defined to separate the scraped search content from the agent's core instructions, nor are there warnings for the agent to ignore instructions embedded within the results.
- Capability inventory: The skill generates a content brief that is then passed to a secondary
write-contentskill. If the brief contains injected instructions from a website, those instructions could be executed or followed by the downstream writing skill. - Sanitization: The skill lacks any mechanism for filtering, sanitizing, or validating the text extracted from the search results before the agent processes it into a structure.
Audit Metadata