signal-monitoring
Pass
Audited by Gen Agent Trust Hub on Feb 13, 2026
Risk Level: LOWPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION] (LOW): Vulnerability to indirect prompt injection through external data processing. The skill ingests untrusted content such as company news, job postings, and social media posts (Example 2). It lacks explicit boundary markers or delimiters to isolate this data from the system instructions. However, the capability is limited to reasoning and template generation (Internal Influence), posing low risk.
- [EXTERNAL_DOWNLOADS] (INFO): The metadata references an external MCP server '@clawfu/mcp-skills'. The author 'ClawFu' is not within the defined trusted organizations. While no code is executed in this file, the dependency itself is unverified.
Audit Metadata