adversarial-ux-test
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to browse and interact with external URLs or staging sites provided by the user. This creates an ingestion point for untrusted data. If a targeted website contains malicious instructions (e.g., hidden in HTML comments or metadata), they could influence the agent's behavior during or after the evaluation phase.
- Ingestion points: Browsing external URLs via browser tools (SKILL.md, Step 2).
- Boundary markers: The skill includes a "Pragmatism Filter" (Step 4) to transition the agent out of the persona, but lacks technical delimiters to isolate content read from the web.
- Capability inventory: The skill enables web browsing, screenshot capture, browser console inspection, and ticket creation in external project management tools (SKILL.md, Steps 2 and 5).
- Sanitization: No sanitization or validation of external web content is described prior to processing.
- [PROMPT_INJECTION]: The skill relies on deep role-play instructions, asking the agent to "fully inhabit" a "grumpy" or "difficult" persona (SKILL.md, Step 2). While this is the intended functional purpose for UX testing, such role-play instructions are a form of prompt engineering that can sometimes lead an agent to adopt behaviors that push against standard safety guidelines if the persona is not strictly bounded.
- [NO_CODE]: The skill is composed entirely of markdown instructions without any associated scripts or executable files. This restricts the potential for classic malware behaviors like remote code execution or privilege escalation, localizing the risk to the interaction logic between the agent and the external content it processes.
Audit Metadata