web-search
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize untrusted data from the internet via a search tool, which presents a standard attack surface for indirect prompt injection.
- Ingestion points: Data enters the context through the output of the
WebSearchtool as defined in theallowed-toolssection ofSKILL.md. - Boundary markers: The instructions do not specify explicit delimiters (like XML tags or triple quotes) to separate search results from the system instructions.
- Capability inventory: The skill's capabilities are limited to
WebSearch. It lacks higher-risk permissions such as file-system writes, network exfiltration tools (curl/wget), or subprocess execution. - Sanitization: No explicit sanitization or filtering of external content is described in the workflow.
- [SAFE]: The skill follows least-privilege principles by restricting tool access to
WebSearchonly. No evidence of credential exposure, obfuscation, or remote code execution was found.
Audit Metadata