design-agent
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides code templates that interpolate external data directly into agent prompts. This pattern creates an attack surface for indirect prompt injection if the inputs are derived from untrusted sources, as the templates do not include sanitization or explicit boundary markers. Ingestion points include ResearchFlow examples in SKILL.md using topic and self.state.research variables. Boundary markers are not present in the provided examples. Capability inventory shows agents with access to web search, scraping, and code execution. Sanitization is not demonstrated in the templates.
- [DYNAMIC_EXECUTION]: The documentation includes instructions for enabling the allow_code_execution feature, which can compile and run code at runtime. Evidence includes configuration examples in SKILL.md demonstrating allow_code_execution=True.
- [COMMAND_EXECUTION]: The skill documents an unsafe code execution mode that runs code directly on the host system. Evidence includes code_execution_mode='unsafe' documented in SKILL.md.
- [EXTERNAL_DOWNLOADS]: The skill provides examples for using tools that fetch content from external sources. Evidence includes examples using SerperDevTool and ScrapeWebsiteTool in SKILL.md.
- [DATA_EXFILTRATION]: The skill describes patterns for agents to send collected data to external destinations. Evidence includes the Slack Reporter agent example in SKILL.md configured to post messages to Slack.
Audit Metadata