search-first
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent ingests and evaluates data from external, untrusted sources including npm, PyPI, GitHub, and general web search results.
- Ingestion points: Research data and package metadata are fetched from external sources in SKILL.md under the 'Full Mode (agent)' and 'Search Shortcuts' sections.
- Boundary markers: The prompt template provided for the researcher subagent does not include delimiters or specific instructions to ignore malicious instructions that might be embedded in search results or package READMEs.
- Capability inventory: The skill encourages powerful actions based on this research, such as installing packages (
npm install,pip install) and adopting code patterns from GitHub. - Sanitization: There is no requirement or logic provided to sanitize external content or verify the integrity (e.g., checksums or version pinning) of the recommended solutions before they are adopted.
Audit Metadata