myob
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for retrieving external data (invoices, customer records, payments) from MYOB and incorporating it into the agent's context, which could potentially contain malicious instructions.
- Ingestion points: External data enters the agent context via
apideck.accounting.invoices.listand related methods inSKILL.md. - Boundary markers: No explicit boundary markers or "ignore instructions" warnings are defined to isolate retrieved data from agent logic.
- Capability inventory: The skill provides capabilities to write data back to MYOB (
invoices.create) and perform arbitrary downstream API calls via the/proxyendpoint. - Sanitization: No sanitization or validation logic is specified for the external content before it is processed by the agent.
Audit Metadata