gs-search
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external website, which could potentially contain malicious instructions intended to influence the agent.\n
- Ingestion points: Paper titles, snippets, and metadata are scraped from scholar.google.com using the evaluate_script tool in SKILL.md.\n
- Boundary markers: There are no explicit instructions or delimiters provided to the agent to disregard instructions that might be contained within the scraped content.\n
- Capability inventory: The skill uses mcp__chrome-devtools__navigate_page and evaluate_script for automated browser interaction.\n
- Sanitization: The scraped metadata is returned to the agent context without sanitization or filtering.
Audit Metadata