acp-fulfillment
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by requiring the agent to ingest and process data from external, non-static sources.
- Ingestion points: The agent is directed to fetch live documentation from external URLs and perform web searches on GitHub for protocol specifications and schemas (SKILL.md).
- Boundary markers: There are no instructions to use delimiters or ignore embedded instructions within the fetched external data.
- Capability inventory: The skill is configured with broad capabilities, including Bash, Write, and Edit tools, which could be leveraged if the agent follows malicious instructions found in search results.
- Sanitization: The skill lacks requirements for sanitizing or validating the external data before it influences the agent's behavior.
Audit Metadata