search-first
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where an agent searches for and evaluates external libraries and code snippets from untrusted sources like npm, PyPI, and GitHub, which represents a risk for indirect prompt injection.
- Ingestion points: Data is retrieved from external package registries (npm/PyPI), code hosting platforms (GitHub), and the public web during the research phase.
- Boundary markers: The skill does not specify the use of delimiters or 'ignore' instructions when processing the content found during searches, which could lead the agent to follow instructions embedded in READMEs or source code.
- Capability inventory: The workflow explicitly suggests capabilities such as
npm install,pip install, and writing new code based on external findings. - Sanitization: There are no instructions for the agent to sanitize, validate, or filter the external content before it is incorporated into the decision-making process or implementation steps.
Audit Metadata