qa-investigator
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by ingesting untrusted data from multiple sources without adequate security controls.
- Ingestion points: The skill reads local files such as
.study-progress.json, user-provided question lists, and note files. Additionally, in Phase 2, sub-agents ingest uncontrolled data from the internet usingWebSearchandWebFetchtools. - Boundary markers: Instructions for sub-agents interpolate "original question text" and "related original paragraphs" directly into prompts. There are no explicit delimiters (e.g., XML tags or clear section headers) or instructions to the agent to disregard any commands found within that text.
- Capability inventory: The skill possesses file read/write capabilities (creating
{chapter-name}-qa.mdand updating.study-progress.json) and network access (viaWebSearchandWebFetch). A successful injection from a malicious web page or source file could potentially cause the agent to write unauthorized content or perform unintended searches. - Sanitization: No sanitization, escaping, or validation is performed on the data retrieved from external files or web searches before it is incorporated into the prompts or final output files.
Audit Metadata