create-tldr-page
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation examples from an external GitHub repository (github.com/jhauga/tldr) and authoritative sources (e.g., git-scm.com) to provide the agent with formatting guidelines and reference data.
- [INDIRECT_PROMPT_INJECTION]: The skill represents a potential vulnerability surface for indirect prompt injection through the processing of untrusted documentation content.
- Ingestion points: The agent is instructed in SKILL.md to fetch content from user-provided documentation URLs and read data from local files passed as parameters.
- Boundary markers: The prompt instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings to isolate external data from the agent's task instructions.
- Capability inventory: The skill utilizes the #fetch tool for network read operations and processes the retrieved text to generate markdown output within the agent context (SKILL.md).
- Sanitization: No evidence of sanitization, validation, or filtering of the fetched content is present in the skill's instructions.
Audit Metadata