research-brief
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it is designed to fetch and process arbitrary web content. However, the instructions include robust defensive rules (Rule 5) specifically mandating that the agent must never follow instructions found within fetched pages and must treat such content solely as data. This follows the industry standard for mitigating indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context via the web fetch tool as described in
SKILL.md. - Boundary markers: The skill explicitly instructs the agent to ignore embedded instructions and separate instructions (user-provided) from content (web-fetched).
- Capability inventory: The skill has the ability to read web content and write to Google Drive or Notion after user confirmation.
- Sanitization: The skill implements a mandatory human-in-the-loop checkpoint, requiring user approval before any external filing occurs.
- [DATA_EXFILTRATION]: While the skill interacts with external services (Google Drive, Notion), it includes strict safeguards. It requires the use of platform-managed OAuth connectors and explicitly forbids filing any information without direct user confirmation (Rule 7).
Audit Metadata