autoglm-open-link
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
open-link.pycontains a hardcoded secret key used for request signing. - Evidence:
APP_KEY = "38d2391985e2369a5fb8227d8e6cd5e5"defined on line 13. - [INDIRECT_PROMPT_INJECTION]: The skill fetches arbitrary text content from external URLs and injects it into the agent's context, which is a known attack surface for indirect prompt injection.
- Ingestion points: The
open_linkfunction inopen-link.pyretrieves thedata.textfield from external websites provided via theurlparameter. - Boundary markers: No delimiters or instructions to ignore embedded commands are present in the
SKILL.mdor the script output. - Capability inventory: The skill has network access to fetch content from the internet.
- Sanitization: There is no evidence of sanitization, filtering, or escaping of the fetched content before it is passed to the agent.
Recommendations
- AI detected serious security threats
Audit Metadata