search
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from the internet, which creates a potential vector for indirect prompt injection attacks where malicious content on a webpage could influence the agent's behavior.\n
- Ingestion points: External data enters the agent context via
web_search_exa(search results) andweb_fetch_exa(page content) tool calls.\n - Boundary markers: The instructions do not define clear separators or "ignore" markers when passing the retrieved content to subagents for processing.\n
- Capability inventory: The orchestrator has the capability to dispatch subagents using the
Agenttool and can write synthesis results to the local./exa-results/directory.\n - Sanitization: There is no description of content filtering or sanitization steps taken on the external data before it is processed by the LLM.\n- [CREDENTIALS_UNSAFE]: The skill documentation suggests that users can provide their API key via a URL query parameter (
?exaApiKey=...).\n - Finding: Using URL parameters to transmit sensitive credentials is a security anti-pattern because the keys can be exposed through browser history, proxy server logs, web server logs, and HTTP Referer headers.
Audit Metadata