prompt-engineering
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous examples of using the
beltCLI tool via Bash to run inference tasks on remote models (e.g., Claude, FLUX, Veo). This usage is consistent with the skill's purpose and is restricted to the vendor-provided tool authorized in the frontmatter. - [INDIRECT_PROMPT_INJECTION]: The "Prompt Templates" section contains structures that ingest external data into prompts, representing an attack surface for indirect prompt injection.
- Ingestion points: The skill defines templates with placeholders such as
[code],[article text], and[topic]intended to be filled with user or external data. - Boundary markers: The templates lack specific delimiters (such as XML tags or unique markers) to clearly separate untrusted input from the instruction block, potentially allowing embedded commands to override the intended task.
- Capability inventory: The skill utilizes the
Bash(belt *)tool to process these prompts and execute tasks on LLMs, image generators, and video models. - Sanitization: There are no instructions or mechanisms provided for sanitizing or escaping the data inserted into the placeholders.
Audit Metadata