blog-brief
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface because it reads external content dynamically during its runtime flow. Specifically, it parses an untrusted file (
DISCOURSE.md) at the project root if available, and fetches live HTML/markdown components from third-party websites during the competitive search phase. - Ingestion points: Reads
DISCOURSE.mdat the project root; extracts headings, metadata, and body snippets from top-ranking pages using standard web search tools in Steps 2, 3, and 4. - Boundary markers: Explicitly instructs the agent to treat
DISCOURSE.mdand fetched competitor data as untrusted data input, command the agent to ignore any embedded directives, and enforce that external textual content must not alter execution behavior. - Capability inventory: Restricted to reading files and performing file-system writing of the finished Markdown brief under
briefs/[slug]-brief.mdor a path designated by the user. - Sanitization: Contains defensive input handling by strictly requiring validation of cited URLs, rejecting unsafe URI protocols (
javascript:,data:,file:), blocking loopback/private/link-local/reserved addresses, and capping response sizes and timeout margins.
Audit Metadata