booking
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves ingesting data from external, untrusted sources, which presents a surface for indirect prompt injection.
- Ingestion points: The skill is instructed to check connected email accounts for confirmations and receipts, and it interacts with third-party provider websites and search results (e.g., ITA Matrix, airline sites).
- Boundary markers: There are no explicit instructions or delimiters defined to isolate external data or to instruct the agent to ignore embedded commands within that data.
- Capability inventory: The skill has the authority to perform financial transactions, place phone calls (phone.place_call), and modify user preferences or calendar data. It also manages local state by writing search results to /tmp/flight-search.json.
- Sanitization: No specific mechanisms for sanitizing or filtering external content are described in the instructions.
Audit Metadata