web-search
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation references the installation of tools from the belt-sh and inference-sh organizations via NPM and GitHub.\n
- Evidence: Mentions npx skills add belt-sh/cli and provides a link to installation instructions at https://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from arbitrary web URLs, creating an inherent attack surface for indirect prompt injection.\n
- Ingestion points: Content is retrieved from external URLs via the tavily/extract and exa/extract applications as seen in SKILL.md.\n
- Boundary markers: No explicit markers or instructions are provided in the examples to isolate untrusted web content.\n
- Capability inventory: The skill is configured to use the belt CLI tool via Bash as defined in the allowed-tools field of SKILL.md.\n
- Sanitization: The documentation does not specify sanitization or validation procedures for the extracted web data.
Audit Metadata