mindtickle-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill leverages WebFetch to ingest external documentation from Mindtickle's web properties. While these are official sources, the ingestion of content into the agent context without explicit boundary markers creates a surface for potential indirect prompt injection attacks.
- Ingestion points: Uses WebFetch to retrieve security materials and compliance documentation from mindtickle.com (SKILL.md).
- Boundary markers: The instructions do not define specific delimiters or guidelines to distinguish external data from system instructions.
- Capability inventory: The agent is granted Read, Glob, Grep, Write, and Edit tools, allowing it to inspect and modify project files based on gathered information.
- Sanitization: There is no explicit requirement for the agent to sanitize or validate the content retrieved via WebFetch before processing it.
Audit Metadata