lov-fact-check
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves retrieving and processing external data from the web, which is an untrusted source. This presents a surface for indirect prompt injection if the retrieved content contains malicious instructions designed to influence the agent's behavior.
- Ingestion points: Web search results and user-provided text/claims analyzed in the workflow described in SKILL.md.
- Boundary markers: The instructions require a highly structured output format (Conclusion, Precise Claim, Evidence Chain) which encourages the separation of external data from the agent's final reasoning.
- Capability inventory: The skill utilizes web search capabilities and the AskUserQuestion tool.
- Sanitization: The workflow includes a mandatory evaluation step to verify evidence quality (labels like [Primary] vs [Secondary]) and identify counterexamples, serving as a logical filter for processed data.
- [PERSISTENCE]: The skill defines a feedback loop mechanism that allows the agent to propose updates to its own rules or shared instructions based on user interactions.
- Evidence: The "General Feedback Loop" section in SKILL.md describes how the agent should categorize feedback and update "canonical Skills" or "shared specifications."
- Safety controls: The process includes explicit requirements for user confirmation and prohibits automatic external writes or commits, mitigating the risk of unauthorized persistent changes to the agent's instruction set.
Audit Metadata