research-expert
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from the web. 1. Ingestion points: WebSearch results and page content fetched from external URLs are processed as defined in SKILL.md. 2. Boundary markers: The instructions lack explicit delimiters or safety prompts to ensure the agent disregards instructions found within external content. 3. Capability inventory: The agent is equipped with the Write tool for file system access and the WebSearch tool for network interaction. 4. Sanitization: There is no process described for sanitizing or validating external input before it is written to files or used in further logic.
- [COMMAND_EXECUTION]: In SKILL.md, the agent is directed to create files in /tmp/ using a name derived from a topic slug. This dynamic path construction poses a risk of path traversal if the input is not sanitized, which could allow writing to unintended directories.
Audit Metadata