train
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external documents and URLs to extract rules, which creates a potential surface for indirect prompt injection. A document could be crafted with instructions designed to influence the agent's future behavior once saved into its training memory.
- Ingestion points: Fetches content from external URLs via the
webfetchtool and reads local file references as specified inSKILL.md. - Boundary markers: No specific delimiters or "ignore embedded instructions" headers are defined for the content analysis phase.
- Capability inventory: The skill has the ability to write to the agent's persistent memory using the
training_savetool. - Sanitization: The workflow includes a mandatory human-in-the-loop step where extracted rules are presented to the user for confirmation before they are saved, significantly mitigating the risk of silent poisoning.
Audit Metadata