yuanbao
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses authoritative override language in the 'CRITICAL: How Messaging Works' section. It explicitly commands the agent to 'NEVER say you cannot send messages', 'NEVER suggest the user do it manually', and 'NEVER add disclaimers about permissions'. While intended to ensure the agent uses the platform's automatic gateway, this style of instruction mimics behavior-override injections used to bypass safety filters or constraints.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates an attack surface where untrusted data (group member nicknames and names) is ingested and then interpolated directly into the agent's response text to trigger @mentions.
- Ingestion points:
yb_query_group_memberstool output (nicknames, member lists). - Boundary markers: Absent. The agent is instructed to include the fetched nickname directly in its reply (e.g.,
@nickname) without delimiters or sanitization. - Capability inventory:
yb_send_dm(private messaging) and file path access for media uploads (media_files). - Sanitization: None. The skill relies on the agent to faithfully copy the nickname string into the final prompt response.
Audit Metadata