crewai
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection based on the provided configuration patterns.\n
- Ingestion points: The 'researcher' agent is configured to use 'SerperDevTool' and 'WebsiteSearchTool' in 'config/agents.yaml', which ingest untrusted content from the internet. Additionally, the 'research_task' in 'config/tasks.yaml' interpolates a user-controlled '{topic}' variable.\n
- Boundary markers: The YAML and Python examples do not include explicit delimiters or system instructions to distinguish between developer commands and external data, nor do they instruct agents to ignore instructions found within retrieved content.\n
- Capability inventory: The skill enables a multi-agent pipeline ('ContentCrew') where agents can execute web searches and pass the resulting data to downstream agents ('writer') for content generation. This allows malicious instructions from a search result to potentially influence the entire crew's output.\n
- Sanitization: There is no evidence of input validation, output filtering, or LLM-based verification of external content before it is processed by the agents.
Audit Metadata