signup-flow-cro
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted web content and external data through
BrowserOS. While the instructions mandate treating this data as hostile and redacting secrets/PII, the lack of explicit technical boundary markers to separate external data from agent instructions creates an attack surface. This is particularly relevant as the agent has access to file writing and terminal execution capabilities. 1. Ingestion points: BrowserOS (SKILL.md) 2. Boundary markers: Absent (includes behavioral instructions but no structural delimiters) 3. Capability inventory: File writing viaMemoryStoreand terminal execution viaExecutionProxy(SKILL.md) 4. Sanitization: Mandated redaction of secrets and PII. - [COMMAND_EXECUTION]: The skill defines an
ExecutionProxy Interface(e.g.,rtk npm test) to perform terminal operations, allowing the agent to execute shell commands within the project environment.
Audit Metadata