weread-skills
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes and displays external content from WeRead API responses, including book metadata, public reviews, and user-generated notes. This data constitutes a potential attack surface for indirect prompt injection, as malicious text could be embedded in this content to influence the agent's behavior.
- Ingestion points: API response fields documented in book.md, notes.md, review.md, and other reference files.
- Boundary markers: No delimiters or protective instructions are used to isolate untrusted data from the agent's primary task instructions.
- Capability inventory: The skill is limited to performing network requests to the author's official domain at i.weread.qq.com.
- Sanitization: The instructions do not include steps to sanitize or validate external content before it is presented to the user.
Audit Metadata