linear
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external web content and data (e.g., via BrowserOS), which presents a surface for indirect prompt injection attacks.
- Ingestion points: The skill explicitly instructs the agent to process web content and external data as part of its operational protocols in SKILL.md.
- Boundary markers: No specific delimiters or 'ignore embedded instructions' warnings are provided to isolate untrusted data from the agent's core instructions.
- Capability inventory: The agent possesses terminal command execution capabilities via an execution proxy ('rtk') and persistent file writing access via the MemoryStore interface.
- Sanitization: The instructions require redacting secrets and PII from context but do not specify technical sanitization or validation of the data's logic or instructions.
- [COMMAND_EXECUTION]: The skill defines a protocol for performing terminal actions using an 'ExecutionProxy' interface (e.g., using the 'rtk' prefix for commands like 'npm test'), which provides the agent with structured access to execute shell commands in the host environment.
Audit Metadata