blog-rewrite
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of blog posts (MDX, Markdown, HTML) to audit and rewrite them. This creates a surface for indirect prompt injection where malicious instructions embedded in a blog post could influence the agent's behavior.
- Ingestion points: Found in SKILL.md under Phase 1, Step 1 ("Read the blog post").
- Boundary markers: The skill lacks explicit instructions to use delimiters or ignore instructions when processing the ingested blog content.
- Capability inventory: The agent can read and write files in the local blog directory, perform network searches (Pixabay, Unsplash), and execute shell commands to verify project builds.
- Sanitization: No sanitization or validation of the ingested blog content is performed before it is processed or used for further actions.
- [COMMAND_EXECUTION]: In Phase 5, Step 8, the skill instructs the agent to "build the project" to verify MDX content. This invokes local build tools which, while part of the intended workflow, represents a capability that could be targeted by malicious project configurations.
- [EXTERNAL_DOWNLOADS]: The skill uses network tools to search for and verify resources from well-known services.
- Evidence: It searches for and verifies image URLs from well-known platforms such as Pixabay and Unsplash, and conducts web searches for statistical data.
Audit Metadata