noise2blog
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands, specifically curl for API requests, cat for file creation, and python3 for JSON parsing. These commands are used to interact with external services and manage local temporary files.
- [INDIRECT_PROMPT_INJECTION]: The skill uses the WebFetch tool to ingest content from user-provided URLs. This creates a risk of indirect prompt injection where malicious instructions embedded in a webpage could attempt to hijack the agent's behavior. Evidence chain: (1) Ingestion points: URL content fetching in SKILL.md (Step 2). (2) Boundary markers: The skill does not define clear boundary markers or instructions to ignore embedded commands within the fetched content. (3) Capability inventory: Includes shell command execution (curl, python3) and network access. (4) Sanitization: No sanitization is performed on the ingested content before it is passed to the LLM generation step.
- [CREDENTIALS_UNSAFE]: API keys (GEMINI_API_KEY and TAVILY_API_KEY) are passed directly into shell commands as environment variables and as a URL query parameter for the Gemini API. This exposure can lead to secrets being logged in the shell history, process lists, or proxy logs.
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to generativelanguage.googleapis.com (Google Gemini) and api.tavily.com (Tavily). These are recognized technology services.
Audit Metadata