drop-off-rescue
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a potential surface for indirect prompt injection attacks.
- Ingestion points: Contact profiles and event data retrieved from ESPs (Step 3, Step 5) and brand website content retrieved via WebFetch (Step 6).
- Boundary markers: A strict confirmation gate (Step 7) is implemented, requiring the user to explicitly approve or schedule any action before the agent executes it.
- Capability inventory: The skill has access to Bash, file write operations, and various ESP-specific campaign management and email sending tools.
- Sanitization: The instructions do not specify any automated sanitization or escaping of external content before it is interpolated into email drafts.
- [EXTERNAL_DOWNLOADS]: The skill uses the WebFetch tool to retrieve content from external URLs provided by the user to analyze brand voice. This is a standard functional requirement for its stated purpose.
- [COMMAND_EXECUTION]: The skill's configuration grants access to the Bash tool. While the current instructions do not contain malicious shell commands, the availability of this tool expands the potential impact of other vulnerabilities.
Audit Metadata