Shortcut Automation
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data ingested from the Shortcut API (such as story descriptions, comments, and workflow names), which constitutes an attack surface for indirect prompt injection. If an attacker places instructions within a Shortcut story that the agent later reads, the agent might attempt to follow those instructions.
- Ingestion points: Data is retrieved via
SHORTCUT_LIST_STORIES,SHORTCUT_LIST_WORKFLOWS, andSHORTCUT_LIST_PROJECTS(SKILL.md). - Boundary markers: No specific delimiters or instructions to ignore embedded commands are provided for processed data.
- Capability inventory: The skill is restricted to Shortcut-specific operations (creating/modifying stories, tasks, and comments) and does not have access to the local filesystem, shell execution, or arbitrary network requests.
- Sanitization: No explicit sanitization of external content is mentioned before interpolation into the agent's context.
Audit Metadata