web-search
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill enables workflows that extract content from the public web and provide it as context for an LLM, creating an attack surface for indirect prompt injection.
- Ingestion points: Untrusted data is retrieved from external URLs using the
tavily/extractandexa/extracttools within SKILL.md. - Boundary markers: The skill documentation suggests using markers like
<search-results>or<content>, but it does not include instructions for the agent to disregard potential commands or malicious patterns embedded in the fetched content. - Capability inventory: The skill has access to the
Bash(belt *)tool, allowing it to run platform-specific search and processing applications. - Sanitization: There is no description of data sanitization, filtering, or validation processes to handle potentially malicious input from the extracted websites.
Audit Metadata