fact-checker
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8) due to the way it processes untrusted Markdown content.
- Ingestion points: The
scripts/fact_checker.pyscript reads the entire content of a user-provided Markdown file via thefile_pathargument. - Boundary markers: Absent. The prompts
SPLIT_PROMPT,CONTEXT_PROMPT, andVERIFY_PROMPTinterpolate user-supplied text directly into the instruction blocks using Python string formatting. There are no clear delimiters (e.g., XML tags or unique tokens) or 'ignore' instructions used to separate the document content from the agent's system instructions. - Capability inventory: The skill has the capability to perform network operations (Google Search via the
google-genailibrary) and write files to the local filesystem (IncrementalWriterclass). An attacker could craft a document that tricks the agent into misreporting facts or exfiltrating data via the search tool. - Sanitization: Absent. The script performs no filtering, escaping, or validation of the input Markdown text before passing it to the LLM.
Audit Metadata