cohere-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The implementation of the agent loop in
SKILL.mdcreates a surface where malicious data from external tools could influence agent behavior.\n - Ingestion points: Data returned by functions in
toolExecutors(such assearch_database) is ingested into the conversational history in theagentLoopfunction.\n - Boundary markers: The implementation lacks delimiters or system instructions that would help the model distinguish between legitimate tool outputs and malicious instructions embedded within those outputs.\n
- Capability inventory: The skill's environment configuration permits the use of
WriteandBashtools, which provides a high-impact execution path if the agent is successfully injected.\n - Sanitization: The
agentLoopdirectly pushes raw tool results into themessagesarray viamessages.push({ role: 'tool', toolCallId: tc.id, content: result })without any validation or escaping of the content string.
Audit Metadata