citilink-connector
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from the Citilink website (citilink.ru) to retrieve product search results and card details.
- Ingestion points: The
citilink_searchandcitilink_cardtools ingest external web content by reading the DOM of Citilink pages via Chrome DevTools Protocol (CDP). - Boundary markers: The instructions do not define explicit boundary markers or delimiters (like XML tags or specific 'ignore instructions' warnings) to prevent the agent from following potential instructions embedded in product titles or descriptions.
- Capability inventory: The skill provides extraction capabilities to turn raw DOM data into structured JSON results for the agent. While it does not explicitly invoke shell commands or network writes with the retrieved data, the agent can use the extracted text in subsequent reasoning steps.
- Sanitization: The instructions focus on accurate extraction using stable
data-meta-*attributes but do not specify any sanitization, filtering, or escaping of the actual text content (titles, snippets) which could contain malicious payloads.
Audit Metadata