omnitag-recommendation
Pass
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts, including scripts/url_to_markdown.py for content extraction and scripts/update_tags.py for modifying the user's local tag configuration file.
- [EXTERNAL_DOWNLOADS]: Fetches and processes content from remote URLs using established services such as Jina Reader (r.jina.ai) and Vercel's markdown.new API.
- [DATA_EXFILTRATION]: Transmits user-provided URLs to external extraction services to convert webpage content into Markdown format for processing.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through the processing of external web content.
- Ingestion points: The agent retrieves arbitrary text and article content from external URLs via scripts/url_to_markdown.py.
- Boundary markers: The instructions lack specific delimiters or warnings to ignore embedded commands within the fetched external content.
- Capability inventory: The skill can write to the local filesystem (~/.omnitag/omni-tags.yaml) and perform network requests to content extraction services.
- Sanitization: No sanitization or filtering is applied to the content retrieved from external sources before it is analyzed by the agent.
Audit Metadata