agent-architecture
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's installation command downloads the instruction content (
SKILL.md) from a public GitHub repository (ollieb89/viflo). - [DATA_EXFILTRATION]: The skill provides example code for a
fetch_urltool that usesurllib.request(Python) andfetch(TypeScript) to retrieve content from arbitrary URLs. This capability creates a risk of Server-Side Request Forgery (SSRF), where an agent could be manipulated into accessing sensitive internal network services or cloud metadata endpoints (e.g., 169.254.169.254). - [PROMPT_INJECTION]: The inclusion of web retrieval functionality creates a surface for indirect prompt injection. If the agent fetches a malicious website, the content could contain hidden instructions that override the agent's primary task.
- Ingestion points: Content retrieved via the
fetch_urltool inSKILL.md. - Boundary markers: None present in the provided code examples to separate external data from system instructions.
- Capability inventory: The agent is granted network access via HTTP clients (
urllib.request,fetch). - Sanitization: No sanitization or validation of the fetched content is performed before it is added to the model's context.
Audit Metadata