catalyst-risk
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from multiple web-based sources including financial forums (via
exa_forum_voice), technology news (via Techmeme), and external corporate job boards. - Ingestion points: Untrusted content enters the agent's context through tools such as
exa_market_voice,exa_forum_voice,hiring_open_roles, and parsing of the Techmeme river feed. - Boundary markers: The skill contains explicit instructions for the agent to treat external content as "voices" rather than facts and specifically directs the agent to not execute any instructions found within that text.
- Capability inventory: The skill possesses the capability to perform file system operations (reading and writing history files in
.local/knowledge/) and call numerous specialized financial data retrieval tools. - Sanitization: The skill descriptions indicate that external text is desensitized before processing, with action-oriented phrasing replaced by placeholders (e.g., 〔动作词〕) to mitigate the risk of the agent interpreting data as commands.
Audit Metadata