product-spec-bulk-fetch
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection because it processes content from external websites to extract structured data.
- Ingestion points: The skill utilizes the
WebFetchtool to ingest content from arbitrary product page URLs provided as input inSKILL.md. - Boundary markers: The instructions lack specific delimiters (e.g., XML tags or unique markers) around the fetched content and do not include explicit warnings for the agent to ignore instructions embedded within the target web pages.
- Capability inventory: The agent is granted significant capabilities across multiple files, including
Write,Edit,Bash, and Google Sheets MCP tools (mcp__google__sheets_values_update), which increases the potential impact if a fetched page contains a successful injection attack. - Sanitization: There is no evidence of pre-processing or sanitization of the fetched HTML/text before it is passed to the extraction prompt.
- [COMMAND_EXECUTION]: The skill requests access to the
Bashtool in its YAML frontmatter. While appropriate for a tool-augmented agent environment (such as Claude Code), the use of a shell-access tool alongside the ability to read arbitrary external web content creates a broader attack surface for potential command injection or exploitation if the agent is misled by malicious data.
Audit Metadata