specificity-rewrite
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests company descriptions and fetches text from external homepages to generate personalized email clauses. This creates a surface for indirect prompt injection where malicious instructions embedded in a company's website could attempt to influence the agent's behavior.
- Ingestion points: Company data rows and public website content fetched during Step 2 (SKILL.md).
- Boundary markers: The skill employs a 'capability list' containing a 'we do NOT do' line to strictly limit the model's promises, and it uses a fixed frame for the final output (SKILL.md, Step 1 & 3).
- Capability inventory: The skill is limited to writing data to specific table columns and performing public web fetches; it lacks capabilities for arbitrary command execution, sensitive file access, or persistence (SKILL.md).
- Sanitization: Output is restricted by specific linguistic rules (lowercase, no trailing period, no company names) and is gated by reading-level measurements to ensure the generated text matches the intended format (SKILL.md, Step 3).
Audit Metadata