rag-fallback

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill processes content fetched from external sources (such as official documentation and GitHub repositories) to update project code. This creates a surface where instructions embedded in external content could potentially influence the agent's behavior.
  • Ingestion points: Uses web_fetch and mcp_fetch to retrieve external documentation as specified in SKILL.md.
  • Boundary markers: Lacks explicit delimiters or instructions for the agent to ignore potential commands within the fetched documents.
  • Capability inventory: The skill is capable of modifying code and reporting status to the user or writing to configuration files based on the fetched information.
  • Sanitization: No explicit sanitization of the retrieved content is described before use in the code modification process.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch documentation. It targets well-known and established resources for Flutter developers, including pub.dev, docs.flutter.dev, and official GitHub repositories.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 01:44 PM
Security Audit — agent-trust-hub — rag-fallback