context-engineering
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for the agent to ingest data from external sources such as tools, documents, and memory stores. This creates a potential attack surface for indirect prompt injection where untrusted data could influence agent behavior.
- Ingestion points: The instructions in Step 3 and Step 4 describe fetching document chunks, memory records, and tool outputs.
- Boundary markers: The Security section mandates tagging external content with provenance to distinguish it from system instructions.
- Capability inventory: The skill discusses dynamic tool binding and execution.
- Sanitization: The instructions explicitly recommend using prompt-injection-defense.skill and treating retrieved content as untrusted.
- [SAFE]: The automated detection of a remote code execution pattern (eval) is a false positive. The scanner flagged the word 'retrieval' because it contains the substring 'eval', which appeared in close proximity to the word 'fetch' in the natural language instructions of Step 3. There is no executable code or malicious logic present in the skill.
Audit Metadata