angel-diligence
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves fetching and processing data from untrusted external websites (Step 3 and Step 4), which presents a surface for indirect prompt injection.
- Ingestion points: The skill spawns subagents to fetch and analyze content from company websites, LinkedIn profiles, GitHub repositories, and news articles (Step 3). It also performs a verification pass by fetching specific high-stakes URLs (Step 4).
- Boundary markers: While the skill provides subagents with strict "Evidence Rules" to prioritize factual citations, it lacks explicit technical boundary markers or delimiters (e.g., specific XML tags or sanitization layers) to isolate fetched content from the agent's instructional logic. This could allow a malicious website to embed instructions designed to influence the research output.
- Capability inventory: The skill possesses the capability to fetch arbitrary external URLs and write structured data to the local file system (e.g.,
diligence/{company-slug}-{YYYY-MM-DD}.md). - Sanitization: There is no evidence of pre-processing or sanitization (such as HTML stripping or filtering) of the fetched web data before it is presented to the subagents for analysis.
Audit Metadata