blog-write

Pass

Audited by Gen Agent Trust Hub on Mar 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs the Bash tool to run curl commands for the purpose of checking the availability of image URLs from external providers. This is a functional requirement for link validation.
  • [EXTERNAL_DOWNLOADS]: The skill fetches data and media assets from well-known services including Pixabay, Unsplash, and Pexels to populate blog content. These operations are aligned with the skill's primary purpose.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface through its research capabilities.
  • Ingestion points: External research statistics and image metadata are ingested from the web using WebSearch and WebFetch during Phase 2.
  • Boundary markers: The instructions do not define specific delimiters to isolate retrieved web content from the agent's internal logic.
  • Capability inventory: The skill has access to Bash, Write, and Edit tools, which could be targeted by instructions hidden in web content.
  • Sanitization: There is no explicit sanitization or validation logic for data retrieved from external sources before it is utilized in the article generation process.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 7, 2026, 04:55 AM