SurveyMonkey Automation
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes survey responses provided by external respondents through the
SURVEY_MONKEY_GET_RESPONSEStool. This external content is untrusted and could potentially contain instructions aimed at the agent. - Ingestion points: The output generated by the
SURVEY_MONKEY_GET_RESPONSEStool (SKILL.md). - Boundary markers: The instructions do not define specific delimiters or warnings for the agent to distinguish between respondent data and operational instructions.
- Capability inventory: The agent has the ability to create surveys (
SURVEY_MONKEY_CREATE_SURVEY), list surveys, and manage distribution links based on processed data. - Sanitization: No explicit sanitization, validation, or filtering of respondent-supplied text is described in the skill instructions.
- [DATA_EXPOSURE]: The skill provides the ability to retrieve sensitive respondent data, including email addresses, first/last names, and IP addresses, through the
SURVEY_MONKEY_GET_RESPONSEStool. This access to Personally Identifiable Information (PII) is a standard feature of survey management tools but represents a sensitive data handling point.
Audit Metadata