target-drug-bd-assessment
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a surface for instructions embedded in that data to influence agent behavior.
- Ingestion points: Data is ingested from external environments via
ls_web_search,ls_paper_search, andls_paper_vector_searchas specified inreferences/legacy-report-spec.md. - Boundary markers: The skill instructs the agent to "separate observed data from strategic interpretation" and label sources, but it lacks strict prompt delimiters (e.g., XML tags or specific block separators) to ensure the agent ignores instructions potentially hidden within the retrieved data.
- Capability inventory: The skill allows the agent to execute a variety of MCP tools (
ls_drug_search,ls_patent_search, etc.) and generate HTML reports to the local file system. - Sanitization: There is no mention of sanitization or filtering logic applied to external data before it is incorporated into the report generation context.
- [EXTERNAL_DOWNLOADS]: The skill uses a web search tool to retrieve information from arbitrary external domains.
- Evidence: The workflow in
references/legacy-report-spec.md(Phase 7) explicitly callsls_web_searchto fetch clinical results (ORR/PFS) from the internet when not available in the primary databases.
Audit Metadata