fact-check
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted text from external URLs and uses it to construct prompts for sub-agents.
- Ingestion points: Content is retrieved from external websites using the
WebFetchtool inSKILL.md(Step 1). - Boundary markers: Instructions for research agents in
SKILL.md(Step 3) do not utilize explicit delimiters (such as XML tags or unique markers) to isolate the untrusted claim text from the agent's instructions. - Capability inventory: The skill possesses write capabilities through the
Edittool for local files and via MCP integrations for external services like WordPress and Google Docs (Step 5). - Sanitization: The skill does not perform automated sanitization or filtering on the retrieved article text before processing.
- Mitigation: The primary defense is a strong human-in-the-loop requirement; the user must manually confirm extracted claims (Step 2) and approve all proposed edits (Step 5) before they are executed, preventing automated exploitation by malicious source content.
Audit Metadata