rss-feed-fix
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill downloads raw HTML from external websites and displays excerpts to the agent, which could allow malicious instructions hidden in that HTML (e.g., in metadata or hidden tags) to hijack the agent's session. 1. Ingestion points: External HTML content is fetched via curl from BLOG_URL and saved to /tmp/feed_fix_live.html (SKILL.md, Step 2). 2. Boundary markers: Absent; no delimiters or instructions to ignore embedded commands are used when the agent reads the data. 3. Capability inventory: The agent can modify local files and execute shell commands like python3 and uv. 4. Sanitization: No sanitization or filtering is performed on the HTML content before it is parsed.
- [DYNAMIC_EXECUTION]: The workflow involves executing Python code snippets via python3 -c and dynamically importing functions (parse_posts) from local modules that the agent is concurrently tasked with modifying. This creates a risk where the agent could be tricked into executing malicious code it just wrote into the module.
Audit Metadata