ddgr
Fail
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to install the
ddgrutility usingsudo apt-get update && sudo apt-get install -y ddgron Linux platforms. This requires privilege escalation to administrative levels, allowing for system-wide modifications during the tool's setup. - [EXTERNAL_DOWNLOADS]: The skill automates the installation of the
ddgrsearch utility through various package managers including Homebrew (brew install ddgr), APT, and the Python package manager (pip3 install ddgr). This process downloads and executes third-party code from external registries to enable search functionality. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by fetching and processing untrusted content from the web.
- Ingestion points: The skill retrieves search result titles, URLs, and abstracts via the
ddgr --jsoncommand inSKILL.md. - Boundary markers: No specific delimiters or "ignore instructions" warnings are used to wrap the untrusted search results, which could lead the agent to follow instructions embedded in web snippets.
- Capability inventory: The skill environment possesses the capability to execute shell commands (as demonstrated by the installation and search commands).
- Sanitization: There is no evidence of sanitization or validation of the search results' text content before it is provided to the agent for interpretation.
Recommendations
- AI detected serious security threats
Audit Metadata