terms-generator
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external websites via WebFetch and local files via Read/Glob to generate Terms of Service documents. Maliciously crafted content in these sources (such as hidden HTML comments or strings in source code) could potentially influence the agent's behavior during the generation process.
- Ingestion points: WebFetch tool is used to scan target URLs, and Read/Glob/Grep tools are used to scan local codebase files.
- Boundary markers: The instructions lack specific guidance for the agent to treat fetched content strictly as data, increasing the risk of the agent following instructions embedded within the scanned content.
- Capability inventory: The skill utilizes WebFetch for network reads, Read/Glob/Grep for file system reads, and Write for generating the output Markdown file.
- Sanitization: There are no instructions provided for sanitizing, escaping, or validating the data retrieved from external sources before it is processed by the agent.
Audit Metadata