doc-coauthoring
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted data from external sources, creating a surface for indirect prompt injection.
- Ingestion points: The workflow encourages users to provide context by pointing to team channels (Slack, Teams), linking shared documents (Google Drive, SharePoint), or performing "info dumps" of project backgrounds in SKILL.md.
- Boundary markers: There are no explicit instructions or delimiters defined to help the agent distinguish between administrative instructions and the untrusted data being analyzed.
- Capability inventory: The skill utilizes create_file and str_replace to write and edit files, and it can invoke sub-agents to test the document's content, creating a path for injected instructions to influence system state or subsequent agent actions.
- Sanitization: The instructions do not specify any validation, filtering, or escaping mechanisms for data retrieved from external integrations or user-provided dumps before it is incorporated into the drafted documentation.
Audit Metadata