customer-review-aggregator
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, attacker-controllable sources such as public review platforms (G2, Capterra, Trustpilot, etc.) via manual paste, CSV uploads, or URL fetching.
- Ingestion points: Data enters the agent context through user-provided review text, uploaded files, or URLs fetched using WebFetch, as described in
references/intake-prompts.md. - Boundary markers: The skill lacks explicit instructions or boundary markers to treat the ingested review data as untrusted text, which could lead the agent to follow instructions embedded within the reviews themselves.
- Capability inventory: The agent utilizes text processing and analysis tools; while no high-risk command execution is documented, the interpolation of untrusted data into analysis prompts is a known vulnerability surface.
- Sanitization: There is no evidence of input validation, escaping, or filtering for instructions hidden within the review content.
Audit Metadata