search-first
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow where the agent retrieves and processes information from untrusted external sources, including npm, PyPI, GitHub, and general web search.
- Ingestion points: Untrusted data enters the agent's context through search results and documentation retrieved from external registries and websites as specified in the "Workflow" (Step 2) and "Full Mode" sections.
- Boundary markers: The skill lacks explicit instructions for the agent to use delimiters or ignore potential commands embedded in the retrieved documentation, making it susceptible to instruction hijacking from malicious package descriptions or repository content.
- Capability inventory: The agent utilizing this skill typically has high-impact capabilities, including the ability to install software via package managers (
npm install), modify project files, and read local configuration files like~/.claude/settings.json. - Sanitization: There are no requirements for the agent to sanitize or validate the content found during the research phase before incorporating it into the final "Decision Matrix" or implementation steps.
Audit Metadata