asking-with-evidence
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a proxy for user queries and video content, which are both untrusted data sources. Instructions in a video (e.g., in the transcript or OCR) could potentially be interpreted by the agent if the engine's output is not strictly bounded.\n
- Ingestion points: User-provided
<question>,<phrase>, and<video_id-or-original-url>inSKILL.md.\n - Boundary markers: The instructions do not define delimiters (e.g., XML tags) or 'ignore' instructions for the agent when processing the output from the
watch-skilltool.\n - Capability inventory: The skill utilizes the
BashandReadtools, providing a pathway for command execution and file access.\n - Sanitization: There are no explicit requirements or steps within the skill to sanitize or validate the data being passed to the
watch-skillcommand.\n- [COMMAND_EXECUTION]: The skill uses theBashtool to interact with thewatch-skillbinary. This creates a potential surface for command injection if the agent interpolates user input (like search phrases or video URLs) directly into the shell string without proper escaping.
Audit Metadata