web-search
Warn
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install external dependencies using
npx skills add belt-sh/cliandnpx skills add inference-sh/skills. These commands download third-party code without version pinning, introducing potential supply chain risks. - [COMMAND_EXECUTION]: The skill uses the
beltCLI to execute remote applications (e.g.,belt app run tavily/search-assistant). This delegates execution to a remote platform, extending the skill's capabilities beyond its local instructions. - [DATA_EXFILTRATION]: User queries, specific questions, and content from targeted URLs are sent to external services (Tavily, Exa, and OpenRouter) via the
beltCLI. This involves transmitting potentially sensitive research data to third-party providers. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. 1. Ingestion points: Untrusted content is fetched from the web using extraction tools. 2. Boundary markers: The provided workflows interpolate this content into prompts (e.g.,
<content>) without delimiters or instructions to ignore embedded commands. 3. Capability inventory: The skill uses network-connected tools to retrieve and process this data. 4. Sanitization: There is no evidence of filtering or sanitization of the extracted content before it is processed by the language model.
Audit Metadata