looker
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- PROMPT_INJECTION (HIGH): The skill presents a high risk for Indirect Prompt Injection. 1. Ingestion points: Files (PDF, images, video, audio) are ingested via the
file_pathparameter. 2. Boundary markers: There are no instructions or delimiters defined to prevent the agent from obeying commands embedded within these files. 3. Capability inventory: The analysis results are structured for consumption by a 'main agent' (like the mentioned 'Coder' agent), which may perform actions based on the poisoned output. 4. Sanitization: No sanitization of the extracted content is performed. - DATA_EXFILTRATION (MEDIUM): The skill accesses local file data and sends it to external servers. 1. Exposure: The tool uses an absolute
file_pathandcdparameter, allowing it to point to any file on the local system. 2. Exfiltration: The configuration requires a Gemini API key and an externalbase_url, meaning local file content or its analysis is transmitted over the network, which contradicts the 'no network access' claim in the documentation.
Recommendations
- AI detected serious security threats
Audit Metadata