month-heads-up
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill ingests text fields from external sources, creating a potential vector where data could influence agent instructions.
- Ingestion points: Transaction details, invoice records, and descriptions are pulled from external integrations like QuickBooks and PayPal in Step 1 and Step 2.
- Boundary markers: The prompt template lacks strict delimiters or parsing constraints to isolate the ingested data fields from the core prompt logic.
- Capability inventory: The workflow has access to configuration tools including Bash and WebFetch, and performs user-facing operations such as drafting email messages.
- Sanitization: No input validation or text sanitization mechanisms are specified for the incoming financial metadata.
Audit Metadata