crewai-multi-agent
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The documentation provides examples of custom tools that use the Python eval() function to process input. In SKILL.md and references/tools.md, the CalculatorTool implementation evaluates arbitrary strings. While one instance in references/tools.md includes a basic sanitization check (isalpha()), this pattern is inherently dangerous if the agent processes input derived from untrusted external sources.
- [INDIRECT_PROMPT_INJECTION]: The multi-agent orchestration pattern described is vulnerable to indirect prompt injection because it ingests data from external sources and provides the agent with high-privilege tools.
- Ingestion points: Untrusted data enters the agent context via search and scraping tools (e.g., SerperDevTool, ScrapeWebsiteTool) as described in references/tools.md.
- Boundary markers: Absent. The task definitions and YAML configurations in SKILL.md do not demonstrate the use of delimiters or instructional guardrails for external data.
- Capability inventory: The skill enables broad capabilities including file system access (FileWriterTool, FileReadTool) and dynamic execution (CalculatorTool in SKILL.md and CodeInterpreterTool in references/tools.md).
- Sanitization: Absent. There is no evidence of robust sanitization or validation of external content before it is interpolated into agent tasks.
- [COMMAND_EXECUTION]: The skill documents the use of the CodeInterpreterTool in references/tools.md, which allows agents to execute generated Python code. When combined with web-scraping capabilities, this creates a path for remote instructions to be executed on the host system.
Audit Metadata