research
Pass
Audited by Gen Agent Trust Hub on Aug 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external primary sources, creating a surface for indirect prompt injection.
- Ingestion points: The skill instructions in
SKILL.mddirect the agent to investigate "primary sources (official docs, source code, specs, first-party APIs)". - Boundary markers: There are no specific delimiters or instructions provided to the agent to ignore or isolate potentially malicious instructions contained within the ingested external data.
- Capability inventory: The agent is authorized to write findings to the local file system, specifically mentioned in
SKILL.md: "Write the findings to a single Markdown file... Save it where the repo already keeps such notes". - Sanitization: The skill lacks explicit sanitization or validation logic for the content it retrieves before performing file-write operations.
- [NO_CODE]: The skill consists solely of natural language instructions and configuration YAML. It does not include any executable scripts, binary files, or automated package installation commands, which limits its direct execution risk.
Audit Metadata