deep-research
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and synthesize large amounts of untrusted data from the web, which is a primary vector for indirect prompt injection attacks.
- Ingestion points: Untrusted data enters the agent context through
firecrawl_scrapeandcrawling_exatools, which fetch content from arbitrary URLs discovered during the search phase (SKILL.md). - Boundary markers: The workflow description does not specify the use of delimiters (e.g., XML tags or triple quotes) or explicit instructions for the agent to ignore potential commands embedded within the scraped content.
- Capability inventory: The skill utilizes web search and scraping tools and includes instructions to save the final report to a file, providing a path for injected instructions to persist or affect the local file system.
- Sanitization: There is no evidence of sanitization, filtering, or validation of the retrieved web content before it is synthesized into the final report.
Audit Metadata