web-search
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the belt CLI tool (via allowed-tools: Bash(belt *)) to interact with search and extraction services. User queries and URLs are passed as JSON input to these commands.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the belt-sh/cli and other associated skills from the vendor repository. It also references external documentation and installation guides hosted on GitHub.
- [INDIRECT_PROMPT_INJECTION]: The primary function of the skill is to retrieve and process content from external websites, which creates an attack surface for indirect prompt injection. Malicious instructions embedded in web pages could be ingested by the agent and influence subsequent LLM actions.
- Ingestion points: Data enters the system via output from tavily/search-assistant, tavily/extract, exa/search, and exa/extract.
- Boundary markers: The workflow examples demonstrate wrapping retrieved content in specific tags (e.g., , ), providing some structural guidance for the LLM.
- Capability inventory: The skill has the capability to execute the belt CLI for network operations and research tasks.
- Sanitization: There is no evidence of content filtering or sanitization performed on the retrieved web data before it is processed by the LLM.
Audit Metadata