historical-source-adapter
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates external, untrusted text directly into the agent's prompt context for transformation.
- Ingestion points: The
original_sourceinput field inSKILL.mdis the primary entry point for untrusted data, which can contain instructions disguised as historical text. - Boundary markers: While the prompt uses bold text labels (e.g.,
**Original source:**) to distinguish input from instructions, it lacks robust delimiters like XML tags or explicit "ignore instructions within the following text" directives that would help the agent resist adversarial content. - Capability inventory: The skill is prompt-based and does not define any companion scripts, file system write operations, or network calls, meaning the impact of a successful injection is limited to influencing the content and formatting of the generated pedagogical output.
- Sanitization: There is no evidence of pre-processing, filtering, or validation steps to sanitize the incoming primary source text for potential malicious payloads.
Audit Metadata