nlweb-prompts-customization
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several files on GitHub (nlweb-ai/NLWeb) to be fetched by the agent or user. These include documentation (nlweb-prompts.md) and configuration files (prompts.xml, sites.xml, tools.xml) necessary for understanding and customizing the prompt architecture.
- [INDIRECT_PROMPT_INJECTION]: The skill describes a system architecture that is vulnerable to indirect prompt injection. 1. Ingestion points: Untrusted data enters the context via the
{prev_queries}and{current_query}fields defined inprompts.xml. 2. Boundary markers: The provided examples do not use explicit delimiters or instructions to ignore embedded commands within the input fields. 3. Capability inventory: The skill specifiesWrite,Edit, andBashas allowed tools in its frontmatter. 4. Sanitization: The system uses<returnStruc>blocks to enforce strict JSON output schemas, which serves as a validation layer for model responses but does not sanitize the input interpolation.
Audit Metadata