modify-agent
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents an agent architecture that processes external data, creating a potential surface for indirect prompt injection where malicious instructions embedded in data could influence agent behavior.
- Ingestion points: Untrusted data enters the agent context via the
request.inputparameter in thestreamingfunction withinagent.py. - Boundary markers: The skill recommends prepending a system message (
AGENT_INSTRUCTIONS) to the message history to guide behavior, which provides basic framing but does not utilize advanced delimiters or 'ignore embedded instructions' warnings for the untrusted content. - Capability inventory: Agents built following these instructions can be equipped with various capabilities, including executing Unity Catalog functions, searching vector indexes, and interacting with external services like Slack or Google Calendar via MCP tools.
- Sanitization: The provided examples do not include explicit sanitization, filtering, or validation steps for the incoming message content before it is processed by the language model.
Audit Metadata