intelligent-content-system
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from external URLs in several scenarios (A1, A2, A3) to generate articles and social media posts. This creates a risk where malicious instructions hidden in the source web pages could influence the agent's behavior during the content transformation or publishing phase.
- Ingestion points: Untrusted data enters the agent context via the
baoyu-url-to-markdowntool, which fetches content from user-provided URLs. - Boundary markers: The skill documentation does not specify the use of delimiters or "ignore embedded instructions" warnings when processing the fetched content.
- Capability inventory: Across its scripts and integrated sub-skills, the system has the capability to write files (Markdown and images) and publish content to external platforms including WeChat, X (Twitter), and Bilibili.
- Sanitization: While the skill performs "format optimization" to clean the Markdown, it lacks explicit mechanisms to sanitize or filter for prompt injection attempts within the ingested text.
Audit Metadata