product-showcase-page
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill researches products using the
web_searchtool and incorporates findings directly into a generated HTML showcase page, creating a potential path for untrusted data to influence the agent's output. - Ingestion points: External product data (features, testimonials, pricing) fetched via
web_searchas described inSKILL.md. - Boundary markers: Absent. There are no explicit instructions to use delimiters or "ignore embedded instructions" warnings when processing the search results.
- Capability inventory: The skill utilizes the
web_searchcapability for network access and performs file writing to create the showcase HTML file (SKILL.md). - Sanitization: Absent. While the skill suggests paraphrasing testimonials, it does not mandate strict escaping or validation for other content gathered from the web before placing it into the final HTML code.
Audit Metadata