ads-audit
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting and processing untrusted data from external websites.
- Ingestion points: The
WebFetchtool is used in Phase 3 to crawl the business homepage, about page, services page, and specific ad landing pages. - Boundary markers: The skill does not define explicit boundary markers or "ignore instructions" warnings when processing the fetched content to build the business context.
- Capability inventory: The skill writes the processed results to
{data_dir}/business-context.json. This file is explicitly described as a shared context for other ads skills (e.g., ad copy generation, landing page analysis), creating a path for malicious instructions to influence downstream agent actions. - Sanitization: There is no mention of sanitization, filtering, or validation of the text retrieved from external URLs before it is provided to the LLM for context extraction.
Audit Metadata