search-first
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it directs the agent to search for and evaluate content from external, untrusted sources such as npm, PyPI, and GitHub.
- Ingestion points: The workflow (SKILL.md) ingest package descriptions, README files, and documentation from external repositories into the agent's context during the 'Parallel Search' and 'Evaluate' phases.
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when the agent processes retrieved external content.
- Capability inventory: The agent is instructed to perform package installations (npm, PyPI) and code generation based on the research findings (SKILL.md).
- Sanitization: There are no requirements for the agent to sanitize or validate the content retrieved from external sources before it influences the agent's implementation decisions.
Audit Metadata