web-research
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from the open web, creating a potential surface for indirect prompt injection.
- Ingestion points: External content is brought into the agent's context via the
WebSearchandWebFetchtools as specified inreferences/search-prompts.mdandreferences/deep-mode.md. - Boundary markers: The prompts use structural headers (e.g.,
SEARCH QUERY,EXTRACT phase) to separate instructions from data, but they do not use specific delimiters or explicit warnings to the model to ignore instructions found within the fetched web content. - Capability inventory: The skill has access to network tools (
WebSearch,WebFetch) and agent delegation capabilities. It writes research findings to a specific local state directory (~/.local/state/web-research/). - Sanitization: The instructions focus on "verbatim" extraction of facts, which serves as a functional constraint, but there is no explicit sanitization or filtering of the raw external data to prevent adversarial content from influencing the agent's behavior.
Audit Metadata