erwa-api
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to retrieve and summarize data from untrusted external sources, such as public group chats, KOL (Key Opinion Leader) posts, and news feeds. This content could contain malicious instructions intended to manipulate the agent's behavior when the data is processed or summarized.
- Ingestion points: Data enters the context through multiple endpoints, including
/api/v1/summaries(AI group chat summaries),/api/v1/group_ca/user_content(raw user chat content), and/api/v1/second_kol(KOL posts) as documented in SKILL.md. - Boundary markers: There are no explicit instructions or delimiters defined to isolate external data from the agent's primary instructions.
- Capability inventory: While the skill itself focuses on data retrieval, the agent using the skill may have broader capabilities (e.g., file management or shell access) that could be exploited if the agent obeys instructions found within the summarized data.
- Sanitization: The documentation mentions automatic filtering for specific 'blocked words' in KOL data, but does not provide general sanitization or escaping mechanisms for prompt injection patterns.
Audit Metadata