kimi-find-skills
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection by processing untrusted data from external sources.
- Ingestion points: External data enters the agent context via
web_search(GitHub) andbrowser_visit(https://skillhub.cn/) as described in Step 3.2 and 3.3. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing the retrieved web content.
- Capability inventory: The skill utilizes
shell(forlscommands),web_search, andbrowser_visit. While it does not automatically execute downloaded content, the agent processes the descriptions and instructions found on these sites. - Sanitization: There is no mention of sanitizing, escaping, or filtering the external content before the agent evaluates it for relevance.
- [COMMAND_EXECUTION]: The skill uses shell commands to interact with the local file system.
- Evidence: Step 3.1 explicitly instructs the use of
ls /app/.agents/skills/to discover local skills. While this is a common discovery pattern for agent tools, it represents a direct command execution capability.
Audit Metadata