peers-advisory-group
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the user and external sources and interpolates it into a generated HTML report without explicit sanitization or escaping instructions. This creates a surface where malicious input could influence the report's structure. \n
- Ingestion points: User input (Step 1) and external search results (Step 6) in SKILL.md. \n
- Boundary markers: Absent. \n
- Capability inventory: baidu-search, baidu-baike, and HTML report generation. \n
- Sanitization: Absent.\n- [EXTERNAL_DOWNLOADS]: The HTML report template in references/report-template.md references external resources from well-known services for styling and typography, including Tailwind CSS and Google Fonts.
Audit Metadata