github-repo-search
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (GitHub repositories) to provide descriptions and recommendations, creating a potential vector for indirect prompt injection.
- Ingestion points: Step 3 (Retrieval) and Step 7 (Deep dive and project introduction) explicitly require the agent to read and process external repository data, including descriptions, topics, and README files from GitHub (SKILL.md).
- Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to disregard instructions embedded within the retrieved repository content.
- Capability inventory: The agent uses the fetched data to perform analysis, categorization, and report generation. While the agent does not execute code or write files based on this data, the output report could be manipulated by adversarial content in project descriptions.
- Sanitization: The workflow does not include steps to sanitize or filter potential instructions found in the repository metadata or README files before they are processed by the LLM.
Audit Metadata