assetseeker

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The agent invokes scripts/seek_assets.py to perform asset searches and list available sources.\n- [EXTERNAL_DOWNLOADS]: The skill includes a download command in scripts/seek_assets.py that fetches files from external creative asset platforms and saves them to the local filesystem.\n- [INDIRECT_PROMPT_INJECTION]: As an internet search tool, the skill ingests metadata from external platforms which could potentially contain instructions aimed at the agent.\n
  • Ingestion points: External asset metadata (titles, tags, descriptions) fetched from third-party APIs and websites via seek_assets.py.\n
  • Boundary markers: The instructions do not define delimiters or warnings to treat external metadata as untrusted data.\n
  • Capability inventory: File system write access via the download command and network access via urllib.request.\n
  • Sanitization: The retrieved text metadata is processed and displayed without explicit sanitization or escaping.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 05:42 AM