customerio
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill facilitates access to sensitive business logic and marketing data by retrieving campaign workflows, segment definitions, and message templates from Customer.io using MCP tools (e.g.,
mcp__customerio__get). - [DATA_EXFILTRATION]: The instructions recommend performing read-only validation queries against production BigQuery tables, such as
customerio_production.push_sent, to audit message send volumes and cohort sizes, which exposes sensitive user engagement metrics to the agent context. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface due to the processing of untrusted data from multiple sources.
- Ingestion points: Data enters the agent context via Customer.io API responses (segments, templates), BigQuery query results, and repository source code (Step 8).
- Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions when interpolating retrieved data into the final 'Campaign Spec' document.
- Capability inventory: The agent uses MCP tools for data retrieval, database tools for BigQuery validation, and file-system access for repository cross-checks and writing artifacts to
tmp/CIO/. - Sanitization: No sanitization, validation, or escaping of external content is specified before the data is processed or documented.
Audit Metadata