jina-cli
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
jinaCLI binary along with standard Unix utilities such ascurlandpbcopyto perform web operations and manage search results. These are standard tools for CLI-based workflows. - [INDIRECT_PROMPT_INJECTION]: The skill's primary functionality involves fetching and reading content from external URLs and search results, which introduces a potential surface for indirect prompt injection. • Ingestion points: The
jina read <URL>andjina search <QUERY>commands ingest arbitrary external content into the agent's context. • Capability inventory: The skill has the capability to perform network requests (jina,curl) and modify clipboard state (pbcopy). • Boundary markers: The instructions do not specify the use of delimiters or specific warnings for the agent to ignore instructions within the fetched content. • Sanitization: No explicit sanitization or filtering of the external content is described. - [DATA_EXPOSURE]: The
jina primercapability provides access to system context, including the current time, user location, and authenticated user identity. This is a documented feature of the Jina CLI used to provide context for AI requests.
Audit Metadata