algolia-audit
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data, creating an inherent surface for indirect prompt injection attacks.
- Ingestion points: The workflow in
SKILL.md(Step 2 and the 'Symptom-Free Checklist') instructs the agent to capture "raw hit payloads" from the search index and "the rendered page (desktop and ~375px) with its console." These sources are controlled by the site data or application state and can contain malicious instructions. - Boundary markers: The instructions do not mandate the use of delimiters or explicit "ignore embedded instructions" warnings when handling the captured data.
- Capability inventory: The skill relies on
algolia-cliandalgolia-mcp, which provide the agent with both read and write capabilities for the Algolia account, increasing the impact if an injection were to occur. - Sanitization: There are no instructions provided to sanitize or filter the content retrieved from the hit payloads or console logs before the agent processes and interprets them.
Audit Metadata