capture-work-in-skilder
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data such as website links, documents, and transcripts to generate workspace configurations. This creates a surface for indirect prompt injection where malicious instructions hidden in the processed data could attempt to influence the agent's output or tool usage.
- Ingestion points: The skill reads content from user-provided links, files, and text snippets as described in Step 2.
- Boundary markers: The instructions do not specify the use of clear delimiters or XML tags to isolate external content from the agent's core logic.
- Capability inventory: The skill utilizes powerful workspace management capabilities via the
managetool, including creating skills, roles, and installing MCP servers. - Sanitization: While the skill explicitly instructs the agent to filter out credentials and personal data (Step 2), it lacks specific defenses against adversarial instructions embedded within the source materials.
Audit Metadata