customer-billing-ops
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it ingests untrusted data from external sources and possesses the capability to perform sensitive operations.
- Ingestion points: Customer emails, support ticket content, and GitHub usernames are read from external billing and communication tools (SKILL.md).
- Boundary markers: While the skill provides guardrails for PII protection, it does not specify the use of delimiters or instructions for the agent to disregard commands embedded within the untrusted customer inputs.
- Capability inventory: The skill allows the agent to perform refunds, cancel subscriptions, and send follow-up communications via connected tools like Stripe (SKILL.md).
- Sanitization: The instructions do not define any sanitization, filtering, or validation steps for the data retrieved from external sources before it is used for decision-making.
Audit Metadata