last30days
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external APIs (Reddit, X, YouTube, etc.) which is then processed by an LLM for planning and ranking. This represents an indirect prompt injection surface. The skill proactively mitigates this by using specific prompt delimiters and instructions to the model to treat external content solely as data and ignore any embedded commands.
- Ingestion points: Data fetched from social media and web search APIs (scripts/lib/aisa.py, scripts/lib/reddit_public.py).
- Boundary markers: Employs untrusted_content tags and explicit safety warnings in reranking prompts (scripts/lib/rerank.py).
- Capability inventory: Subprocess execution of local scripts for orchestration and database storage of findings.
- Sanitization: Prompt engineering is used to prevent the model from following instructions found in scraped content.
- [COMMAND_EXECUTION]: The skill uses the Python subprocess module to execute its own component scripts and standard tools like git for benchmarking (scripts/watchlist.py, scripts/evaluate_search_quality.py). These operations are part of the skill's core functionality for managing a research watchlist and do not allow for arbitrary command injection from external sources.
Audit Metadata