QuickBooks Automation
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external and untrusted data including transaction descriptions, expense receipts, and customer information. This data is interpolated into templates for invoices and automated categorization rules, creating a potential surface for indirect prompt injection where malicious instructions embedded in source documents could influence agent behavior.
- Ingestion points: SKILL.md (input section, receipt_automation section) defines transaction data, expense receipts, and bank statements as primary inputs.
- Boundary markers: The skill uses template syntax (e.g., {{customer_name}}, {{service_description}}) in the invoice_template section, but does not specify robust delimiters to isolate external content from instructions.
- Capability inventory: The skill has access to QuickBooks MCP tools (qb_invoice, qb_expense, qb_customer, qb_reports) and includes automation rules that can trigger emails.
- Sanitization: The instructions do not define any sanitization, filtering, or validation steps for content extracted from external financial sources.
Audit Metadata