cali-degustia-client-news-watch
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by design. In Step 3, it ingests data from untrusted external sources (Reddit, X, Hacker News, and the wider web) to search for news and community signals.
- Ingestion points: External content fetched via the
last30daysandresearcher-webtools (SKILL.md, Step 3). - Boundary markers: The instructions lack specific boundary markers or delimiters to isolate untrusted web content from the agent's internal logic.
- Capability inventory: The skill possesses the capability to read local files in sensitive directories (
~/.agents/skills/cali-degustia-diagnostico/assets/) and generate structured JSON reports (SKILL.md, Step 1 & 5). - Sanitization: There are no explicit instructions for the agent to sanitize or validate external content before using it to generate personalized messages or structured outputs.
- [DATA_EXFILTRATION]: The skill accesses sensitive local information, including client report files containing industry context, pain points, and potentially PII such as names and emails. While it does not automatically transmit this data to a remote server, it consolidates it into a structured JSON format intended for integration with external CRM and automation tools (Step 5). This concentration of data increases the impact if the output is mishandled.
Audit Metadata