velt-rewriter-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of a feature that ingests user-selected text from a webpage and processes it via LLM models through the
askAimethod. This inherent workflow creates an indirect prompt injection surface where instructions embedded in processed content could influence the agent's behavior. - Ingestion points: The
event.textfield, emitted by theon('textSelected')observable inrules/shared/api/api-on-text-selected.md, is the primary source of untrusted data. - Boundary markers: The implementation examples do not explicitly demonstrate the use of delimiters or specific framing instructions to isolate user content within the AI prompt.
- Capability inventory: The skill documents capabilities to perform network-based AI generation (
askAi), in-place DOM modification (replaceText), and data persistence via anchored comments (addComment). - Sanitization: The provided patterns do not include explicit validation or sanitization steps for the input text before it is processed by the AI service.
Audit Metadata