study
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's core function is to ingest external data for analysis, which introduces a potential surface for malicious instructions embedded in that data.
- Ingestion points: The 'Begin with the thing itself' section of SKILL.md instructs the agent to observe artifacts and read primary materials, history, and independent sources.
- Boundary markers: There are no instructions to use specific delimiters or to treat ingested content as untrusted 'data' rather than 'instructions'.
- Capability inventory: The skill instructs the agent to use 'best available source tools' and perform searches, while also advising the agent to 'not expose private step-by-step reasoning', which could obscure the impact of a successful injection from the user.
- Sanitization: The skill lacks any requirement to validate, sanitize, or filter the external content before it is processed by the LLM.
Audit Metadata