learn
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The instructions mention using
curlas a fallback method to fetch content from web pages when specialized reading tools are unavailable. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from a variety of external sources, including search results, web pages, and public repositories. This creates a surface for indirect prompt injection if the fetched content contains malicious instructions.
- Ingestion points: Phase 1 (Collect) utilizes search plugins and network fetch tools to bring external content into the agent's context from URLs, GitHub, and Chinese social platforms.
- Boundary markers: While the skill emphasizes source tracking and evidence-based drafting, it does not explicitly instruct the agent to use delimiters or "ignore embedded instructions" warnings when processing fetched text.
- Capability inventory: The skill possesses the ability to perform web searches, fetch external content via network tools, and write output to local files.
- Sanitization: The instructions for "Conversation Or Review Distillation" in Phase 2 proactively require the redaction of private paths, repo-specific commands, and raw conversation history from the final output.
Audit Metadata