crewai
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions demonstrate patterns that ingest untrusted user input into agent prompts via template variables, creating a surface for indirect prompt injection.
- Ingestion points: The examples in config/agents.yaml and config/tasks.yaml use the {topic} variable to dynamically construct prompts for agents and tasks.
- Boundary markers: The provided patterns do not include delimiters or specific instructions for the agent to ignore instructions embedded within the interpolated data.
- Capability inventory: The defined agents are configured with SerperDevTool and WebsiteSearchTool, which allow them to interact with external, potentially attacker-controlled content from search engines and websites.
- Sanitization: There is no demonstration of input validation, output filtering, or content sanitization to mitigate the risk of data poisoning.
Audit Metadata