doc
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches web content through the Jina.ai reader service (
https://r.jina.ai/<url>). Jina.ai is a well-known service for converting web pages into markdown format for LLM consumption. - [PROMPT_INJECTION]: The skill introduces a surface for indirect prompt injection. It downloads arbitrary web content and stores it as markdown files in the project directory, while instructing the agent to 'check local docs first' and reference them. If an attacker-controlled URL is provided, the resulting markdown file could contain instructions designed to manipulate the agent's behavior when it later reads the file.
- Ingestion points: External content is fetched and saved to
$PROJECT/docs/external/<name>/README.md. - Boundary markers: The skill does not implement boundary markers or instructions to help the agent distinguish between legitimate documentation and embedded malicious prompts.
- Capability inventory: The skill uses file system write operations and network requests. The agent processing the cached files may have additional capabilities such as command execution or file modification.
- Sanitization: There is no evidence of sanitization, filtering, or validation of the fetched content before it is stored and presented to the agent.
Audit Metadata