jina-reader
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides a mechanism for the agent to ingest arbitrary content from external web pages, which is a common vector for indirect prompt injection.
- Ingestion points: Data is fetched from remote URLs and search queries via the Jina AI API endpoints (
r.jina.ai,s.jina.ai,g.jina.ai) inscripts/reader.sh. - Boundary markers: The skill does not implement delimiters or specific instructions to help the agent distinguish between its own logic and the content fetched from the web.
- Capability inventory: The script uses
curlto perform network operations andjqfor JSON processing, returning the resulting text or markdown directly to the agent's context. - Sanitization: There is no evidence of filtering or sanitization of the fetched content to prevent the execution of embedded instructions or malicious patterns found in the source web pages.
Audit Metadata