broadcast-coverage-comparison
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and compare broadcast coverage data, including human captions, machine-generated transcripts, and OCR text from television news, which constitutes untrusted external input.
- Ingestion points: Data is fetched via
scripts/crawlora.shfrom the GDELT Television 2.0 AI index endpoints onapi.crawlora.net(e.g.,/gdelt/tv-search,/gdelt/tv-timeline). - Boundary markers: While instructions guide the agent to "Quote briefly and attribute captured speech/text" and caution that the data is unverified, there are no strict technical boundary markers or instructions to ignore embedded commands in the processed data.
- Capability inventory: The skill has limited execution capabilities, restricted to making GET requests to a specific whitelist of GDELT API routes through the provided bash script.
- Sanitization: The helper script
scripts/crawlora.shimplements robust sanitization for outgoing requests (URL-encoding parameters, validating API key format, and enforcing a route whitelist), but the content returned from the external API remains unvalidated raw text.
Audit Metadata