go-in-depth
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites during its research phases, creating a potential surface for indirect prompt injection.
- Ingestion points: In
scripts/workflow-script.js, the "Fetch" phase retrieves content from external URLs, and the "Search" phase retrieves snippets and titles from web search results. - Boundary markers: The agent prompts (e.g.,
FETCH_PROMPT,VERIFY_PROMPT) interpolate external data like URLs, titles, and quotes directly into the instructions without delimiters or specific warnings to ignore embedded instructions. - Capability inventory: The skill utilizes
WebSearchandWebFetchto interact with external network resources. - Sanitization: No explicit sanitization or filtering of fetched content is performed. However, the workflow enforces strict JSON schemas for all agent responses, which significantly limits the ability of injected content to hijack the agent's output format or execute commands.
Audit Metadata