email-prompt-building
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data and interpolates it into prompt templates, creating a surface for indirect prompt injection.
- Ingestion points: Processes external "Campaign context", "Hypothesis set", "Enrichment columns", and "Signal data" to build templates (SKILL.md).
- Boundary markers: The synthesis logic uses direct placeholder interpolation (e.g., {field}, {sender}) but lacks specific delimiters or instructions to treat the ingested data as potentially untrusted content.
- Capability inventory: The skill writes prompt templates to the file system (campaigns/{campaign-slug}/prompts/first_email.md) which are then consumed by downstream automation tools.
- Sanitization: No evidence of sanitization, validation, or escaping of the enrichment fields or signal data before they are included in the generated prompt templates.
Audit Metadata