blog-outline
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves data from external web pages using WebSearch and WebFetch tools in Step 2. This creates a surface for indirect prompt injection, where malicious instructions could be embedded in competitor blog posts or search results to influence the agent's behavior. The skill includes specific mitigation instructions, such as telling the agent to ignore page instructions and validating URL protocols (rejecting javascript:, data:, etc.), which reduces but does not eliminate the risk.\n
- Ingestion points: WebSearch snippets and WebFetch page content as described in Step 2 of SKILL.md.\n
- Boundary markers: Explicit instructions are provided to ignore page instructions and treat fetched pages as untrusted data within the SKILL.md instructions.\n
- Capability inventory: The skill combines network read operations (WebFetch) with local file write capabilities (saving to the outlines/ directory) as defined in SKILL.md.\n
- Sanitization: The instructions in SKILL.md mandate protocol filtering (http/https only), IP address validation, and size/timeout caps for external requests.\n- [COMMAND_EXECUTION]: The skill instructs the agent to perform file system operations, including creating a directory (outlines/) and writing content to files in Step 5. It also references local paths using parent directory navigation (../blog/references), which requires the agent to resolve and access paths outside the immediate skill directory as specified in the workflow logic.
Audit Metadata