source-synthesis
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from user-provided URLs, which serves as a major ingestion point for indirect instructions.
- Ingestion points: The 'Reading phase' in
SKILL.mdinstructs the agent to fetch and read content from every URL provided by the user. - Boundary markers: The instructions do not define any delimiters or provide directives to ignore potentially malicious instructions embedded within the fetched content.
- Capability inventory: The skill uses network fetching tools and has the ability to write to the local file system at
./docs/approach.md. - Sanitization: No sanitization, validation, or escaping of the fetched content is specified. The agent is explicitly told to 'Include code snippets, commands, or configuration examples' from these external sources.
- [COMMAND_EXECUTION]: The synthesis process distills 'practical patterns' including executable commands and code snippets from untrusted remote URLs directly into a project file (
./docs/approach.md). This creates a risk where a user may inadvertently trust and execute malicious code extracted from a compromised or adversarial source.
Audit Metadata