inbound-from-domain-kickoff
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (
score.py) to analyze and score inbound email data provided in JSON files. This is demonstrated in the 'Sample loop' section and reflected in theallowed-toolsconfiguration. - [INDIRECT_PROMPT_INJECTION]: The skill processes the contents of
gtm/inbound.jsonto determine the next steps in its workflow, creating an entry point for potential indirect prompt injection attacks. - Ingestion points: The agent reads data from
gtm/inbound.json(as seen in the 'Start' and 'State' sections) to decide on task routing. - Boundary markers: The instructions lack explicit delimiters or specific warnings for the agent to ignore any natural language instructions that might be embedded within the JSON data.
- Capability inventory: The skill possesses the capability to execute shell commands (
python3) and read files within the skill's directory structure. - Sanitization: There is no mention of sanitizing or validating the contents of the
gtm/inbound.jsonfile before it is interpreted by the agent.
Audit Metadata