press-release-writing
Warn
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of external software from the 'belt-sh' and 'inference-sh' repositories.
- [REMOTE_CODE_EXECUTION]: Instructions guide the user to download and execute code packages using the
npx skills addcommand, which allows for running external code in the agent's environment. - [COMMAND_EXECUTION]: The skill utilizes shell-based commands through the 'belt' CLI to perform account management ('belt login') and execute research tools ('belt app run').
- [PROMPT_INJECTION]: Vulnerability to indirect prompt injection exists through the research and fact-checking components where untrusted data may be ingested.
- Ingestion points: External data enters the agent context through search queries and questions executed via the 'belt app run' command in SKILL.md.
- Boundary markers: There are no explicit delimiters or instructions to ignore embedded commands in the data retrieved from external research tools.
- Capability inventory: The skill utilizes the 'Bash' tool to execute the 'belt' CLI and its associated sub-apps.
- Sanitization: No validation or sanitization of search queries or retrieved content is specified in the instructions.
Audit Metadata