best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface by fetching industry best practices and standards from the public internet using the WebSearch and WebFetch tools.
- Ingestion points: External data from web searches and direct URL fetches are ingested into the agent context in Phase 1 (Industry Research) as documented in SKILL.md.
- Boundary markers: The skill includes an "Untrusted content rule" explicitly instructing the agent to treat all fetched content as untrusted, ignore instructions found in pages, and cross-verify claims across independent sources.
- Capability inventory: The skill has access to the filesystem (Read, Grep, Glob) and can orchestrate sub-agents and other skills (Agent, Skill).
- Sanitization: The instructions specifically forbid executing commands or code snippets retrieved from external web sources.
- [COMMAND_EXECUTION]: The skill performs repository-wide searches and file reads based on a user-provided scope.
- The instructions include a mandatory validation step for the
--scopeargument, requiring the rejection of absolute paths and parent directory traversal (..) to prevent unauthorized access to the host filesystem. - [EXTERNAL_DOWNLOADS]: The workflow relies on retrieving external documentation, RFCs, and industry standards.
- The skill uses a prioritized cascade of web tools (agent-browser, WebSearch, WebFetch) to gather research data from the internet.
Audit Metadata