substack-research
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes external content from Substack (posts, notes, and profiles), which is an untrusted source that could contain malicious instructions.
- Ingestion points: Data enters the agent context through the outputs of the scripts/crawlora.sh script when calling the various Substack API endpoints.
- Boundary markers: While SKILL.md provides instructions to distinguish excerpts from analysis, there are no technical delimiters used in the tool output to isolate external content from the agent's instructions.
- Capability inventory: The skill has network access to the vendor's API (api.crawlora.net) but lacks high-privilege capabilities such as arbitrary file writing or system command execution.
- Sanitization: The helper script properly URL-encodes outgoing parameters to prevent command injection at the request layer, but does not sanitize the incoming text from Substack to remove potential instruction-like strings.
Audit Metadata