webapp-qa
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input and interpolates it into a delegation prompt for the
qasubagent. This creates an attack surface where malicious content on a target website or in the flow instructions could influence the subagent's behavior. - Ingestion points: The URL and
-- <flow instructions>arguments defined inSKILL.mdare passed directly to theqaagent. - Boundary markers: Absent. The prompt templates in
SKILL.md(e.g., 'Focus on:<flow instructions>') lack explicit delimiters or instructions to ignore embedded commands. - Capability inventory: The delegated subagent possesses significant capabilities including browser navigation, form interaction, button execution, and running Lighthouse audits as described in
SKILL.md. - Sanitization: Absent. There is no evidence of URL validation or instruction filtering before interpolation.
Audit Metadata