linktree-core-workflow-a
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from the Linktree REST API, including profile metadata and link details. This introduces a surface for indirect prompt injection if an attacker-controlled profile contains malicious instructions in the bio or title fields.
- Ingestion points: External data enters the agent context through the
client.profiles.getandclient.links.listmethods described inSKILL.md. - Boundary markers: The provided code snippets do not include explicit delimiters or instructions for the agent to ignore potentially malicious commands embedded in the API response.
- Capability inventory: The skill enables
Read,Write,Edit, andBashtools, which could be leveraged if an injection succeeds. - Sanitization: The implementation examples do not demonstrate sanitization or validation of the text content retrieved from the API.
- Mitigation: Treat all data returned from the Linktree API as untrusted. Use boundary markers when interpolating this data into prompts and explicitly instruct the agent to ignore any embedded instructions.
Audit Metadata