customer-persona
Warn
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install a third-party CLI tool using
npx skills add belt-sh/cliand references installation instructions hosted athttps://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md. These sources and the associatedinference.shservice are not recognized as trusted vendors or well-known services, posing a supply chain risk. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external search services, which are potentially attacker-controlled.
- Ingestion points: Data from external search assistants (
tavily/search-assistant,exa/search, andexa/answer) is retrieved and processed by the agent via thebeltCLI tool (SKILL.md). - Boundary markers: Absent. The instructions do not define delimiters or provide guidance to the agent to ignore instructions embedded in the external data.
- Capability inventory: The skill uses
Bash(belt *)to execute CLI commands and interact with remote services. - Sanitization: Absent. There is no evidence of filtering, escaping, or validation of the data retrieved from external sources before it is interpreted by the agent.
Audit Metadata