search-first

Pass

Audited by Gen Agent Trust Hub on Jun 24, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill facilitates indirect prompt injection by instructing the agent to search and process content from external untrusted sources such as npm, PyPI, GitHub, and general web search results.
  • Ingestion points: External content fetched by the researcher subagent as defined in SKILL.md.
  • Boundary markers: Absent; the provided prompt template for the research agent does not include delimiters or instructions to ignore embedded commands in the search results.
  • Capability inventory: The skill workflow leads to package installation (npm/pip) and direct code adoption (file writes), creating a path from untrusted input to system modification.
  • Sanitization: Absent; the workflow lacks a verification or sanitization step for content retrieved from external sources.
  • [EXTERNAL_DOWNLOADS]: The skill explicitly recommends searching for and installing third-party dependencies from public registries (npm, PyPI) and GitHub repositories.
  • [COMMAND_EXECUTION]: The workflow involves executing local search commands (ripgrep) and package managers (npm, pip) to integrate discovered solutions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 24, 2026, 12:58 PM
Security Audit — agent-trust-hub — search-first