israeli-company-lookup
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it ingests and processes data from external government databases.
- Ingestion points: The skill fetches JSON company records from the
data.gov.ilCKAN API as defined in the programmatic lookup instructions. - Boundary markers: The instructions do not specify the use of delimiters or framing techniques to prevent the agent from following instructions potentially embedded within the fetched data.
- Capability inventory: The skill's capabilities are restricted to the
WebFetchtool; it does not have access to shell command execution, file system modifications, or sensitive credentials. - Sanitization: There is no evidence of sanitization or content filtering for the data retrieved from the API before it is processed by the agent.
- [EXTERNAL_DOWNLOADS]: Fetches company registrar information and dataset metadata from official Israeli government domains including
data.gov.ilandica.justice.gov.il.
Audit Metadata