internal-comms
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from several untrusted or externally-influenced sources, which presents a vulnerability to indirect prompt injection attacks.
- Ingestion points: The instructions explicitly direct the agent to pull information from Slack posts, Google Drive documents, emails, calendar events, and external press articles (
examples/3p-updates.md,examples/company-newsletter.md,examples/faq-answers.md). - Boundary markers: The prompt templates lack clear boundary markers (e.g., XML tags or specific delimiters) or instructions to ignore embedded commands within the fetched data, increasing the likelihood that the agent might follow malicious instructions found in a document or message.
- Capability inventory: The skill leverages the agent's capability to read communication history and documents to perform summarization and formatting tasks.
- Sanitization: There is no mention of sanitizing, filtering, or validating the content retrieved from these sources before it is processed by the LLM.
Audit Metadata