yao-agent
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to download and manage agent source code, which represents a potential surface for indirect prompt injection if the ingested code contains instructions that the agent processes without sanitization.
- Ingestion points: The
agent_downloadandagent_referencetools fetch source code from a host into the local environment (SKILL.md). - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded prompts within the retrieved source code.
- Capability inventory: The skill includes discovery (
agent_list), retrieval (agent_download/agent_reference), and deployment (agent_deploy) capabilities. - Sanitization: There are no explicit instructions for the agent to sanitize or validate the content of the source code it retrieves.
Audit Metadata