insurance-agent-policy-explanation
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes policy data from external tools and user queries which creates a surface for indirect prompt injection. \n
- Ingestion points: Data retrieved from the
product-systemMCP tool and raw user-provided queries defined inSKILL.md. \n - Boundary markers: The system prompt lacks explicit delimiters or instructions to treat external data as non-executable text, which could lead to instructions embedded in policy text being obeyed by the agent. \n
- Capability inventory: The skill utilizes MCP tools to fetch product details and clauses. \n
- Sanitization: No content-based sanitization is implemented in
scripts/validate_input.pyto filter malicious patterns in ingested data. \n- [DATA_EXPOSURE]: Absolute local file paths from the developer's environment are visible in the manual testing documentation, which can reveal information about the host system structure. \n - Evidence: The file
TEST.mdcontains multiple references to directory structures starting with/Users/zhangjia/Documents/客户/保险/技能/.
Audit Metadata