collector-hand-skill
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The system prompt in
HAND.tomldirects the agent to utilizeshell_execto run a Python one-liner:python -c "import platform; print(platform.system())". This command is used for environment detection at startup. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection due to its core functionality of fetching and analyzing external web data.
- Ingestion points: The agent uses
web_fetchto retrieve full content from websites discovered viaweb_searchas described in Phase 3 of the system prompt inHAND.toml. - Boundary markers: The instructions lack specific delimiters or warnings for the agent to ignore or isolate instructions that might be embedded within the retrieved web content.
- Capability inventory: The skill is equipped with highly capable tools including
shell_exec,file_write,event_publish, andschedule_create, which increases the potential impact of a successful injection attack. - Sanitization: No explicit sanitization or validation logic is defined to inspect the fetched content for malicious patterns before processing it for entity extraction and knowledge graph construction.
Audit Metadata