customer-persona

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to install a third-party CLI tool using npx skills add belt-sh/cli and references installation guidelines hosted on a GitHub repository (https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md).
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute belt CLI commands. These commands are used to perform authenticated market research via search assistants (Tavily, Exa) and generate persona avatars using image generation models (FalAI).
  • [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests untrusted data from external search results to populate persona templates.
  • Ingestion points: Data enters the context via belt app run commands targeting tavily/search-assistant and exa/search (SKILL.md).
  • Boundary markers: None are explicitly used in the provided command examples to separate search results from the agent's internal logic.
  • Capability inventory: The skill has access to the Bash tool to run CLI applications.
  • Sanitization: There is no evidence of automated sanitization for the search results before they are processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 02:18 PM
Security Audit — agent-trust-hub — customer-persona