read
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted web pages and document content, presenting an indirect prompt injection surface.\n
- Ingestion points: Arbitrary URLs and PDF documents ingested via
scripts/fetch.sh,scripts/fetch_local.py,scripts/fetch_feishu.py, andscripts/fetch_weixin.py.\n - Boundary markers: Present.
SKILL.mdcontains strict rules instructing the agent to treat all fetched content as untrusted data and ignore embedded overrides, urgency appeals, or role reassignments.\n - Capability inventory: The skill executes local bash and python helper scripts, downloads images, and writes output to local session directories.\n
- Sanitization: Standard HTML parsing and text extraction are performed, but raw extracted text is passed to the model context, relying on the model's adherence to safety guidelines.\n- [COMMAND_EXECUTION]: Command templates defined in
references/read-methods.mdinterpolate user-controlled variables such as{url},{user}, and{repo}into shell commands. If the agent executes these directly via a shell wrapper without proper escaping, it could lead to command injection if a user supplies a malicious URL with shell metacharacters.
Audit Metadata