app-rejection-recovery
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data by instructing the agent to ask users for their full, verbatim app rejection messages. This creates a potential surface for indirect prompt injection if a rejection message were to contain malicious instructions intended to manipulate the agent's output.
- Ingestion points: The skill instructs the agent in
SKILL.mdto "Ask the user to paste the full rejection message verbatim — including the guideline number(s)". - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are provided to separate the user-provided rejection content from the agent's internal logic.
- Capability inventory: The skill does not possess capabilities for network operations, file system writes, or subprocess execution, significantly limiting the impact of any potential injection.
- Sanitization: There is no explicit sanitization or validation logic defined for the external text input.
Audit Metadata