investment-proposal
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill's workflow involves ingesting and processing external data from prospective clients, which could potentially contain unexpected instructions.
- Ingestion points: Prospect context such as 'Current situation', 'Goals', and 'Constraints' defined in SKILL.md (Step 1) are gathered from external sources.
- Boundary markers: The instructions do not currently include specific delimiters or 'ignore embedded instructions' warnings for the data being processed.
- Capability inventory: The skill is restricted to information gathering and proposal structure; no script execution, network operations, or file-system writing capabilities were identified in the provided content.
- Sanitization: The workflow does not explicitly define sanitization or validation steps for the prospect-provided content before it is interpolated into the proposal template.
Audit Metadata