tidy
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted transaction descriptions as input for its clustering and categorization logic.
- Ingestion points: The
queryMCP tool fetches transaction descriptions which are external data. - Boundary markers: The instructions do not specify any delimiters or safety markers for processing these descriptions.
- Capability inventory: The skill has the capability to perform web searches, search user emails, create categorization rules via an
admintool, and modify transaction metadata. - Sanitization: There is no evidence of sanitization or filtering for the transaction descriptions before they are used in search queries or rule suggestions.
- Mitigation: The workflow includes a mandatory user approval step (Step 5), where the agent must ask the user to approve, modify, or skip suggested clusters before executing any modification tools.
Audit Metadata