exa-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted content from external URLs, which represents a potential attack surface for indirect prompt injection.
- Ingestion points: The functions
findSimilarAndContents,getContents, andanswerdocumented inSKILL.mdare designed to fetch text, highlights, and summaries from the web into the agent's context. - Boundary markers: The provided code examples do not demonstrate the use of delimiters or specific instructions to the agent to disregard instructions embedded within the retrieved web content.
- Capability inventory: The skill's environment (defined in the YAML frontmatter) includes capabilities such as
Write,Edit, andBash, which could be targeted by an injection attack if the agent attempts to follow instructions found in retrieved data. - Sanitization: The skill provides raw data retrieval; no filtering, validation, or sanitization of the external content is implemented in the provided logic.
Audit Metadata