pet-care-provider-shortlisting
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the Rover platform (including sitter bios, trainer headlines, and public review excerpts) fetched via the Crawlora API to build shortlists.
- Ingestion points: Data from the
/rover/searchand/rover/trainer-searchendpoints is used to generate provider summaries inSKILL.md. - Boundary markers: Absent. The instructions do not specify delimiters or warnings to ignore instructions that might be embedded in provider profiles.
- Capability inventory: The skill includes a helper script (
scripts/crawlora.sh) that executescurlto perform network operations. - Sanitization: The helper script performs URL-encoding on outgoing query parameters, but does not sanitize the text content received from the API before it is processed by the agent.
Audit Metadata