fetch-content
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill serves as a conduit for untrusted data from the web and local filesystem, creating an attack surface for indirect prompt injection where malicious content could influence the agent's behavior.
- Ingestion points: Data is ingested from user-provided URLs and local file paths through
scripts/fetch.py, utilizingrequests,yt-dlp,trafilatura, andpymupdf. - Boundary markers: The skill explicitly implements a security protocol ('untrusted-content-contract:v1') that wraps external content in
<untrusted-content>tags to clearly demarcate it from system instructions. - Capability inventory: The tool possesses capabilities to perform network requests to any URL, read local files, and process various document formats.
- Sanitization: The script includes comprehensive defensive logic: it neutralizes attempts to spoof the closing boundary tag (using a case-insensitive, whitespace-tolerant regex), escapes the source URL using JSON encoding to prevent attribute injection, and removes non-printable control characters that could be used to obfuscate text.
Audit Metadata