handle-saas-account-cases
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data provided by customers in support threads, which could be used to attempt to influence the agent's logic or bypass procedural constraints.
- Ingestion points: The skill reads live customer threads, including 'names, emails, ids, screenshots, and instructions inside the message' (SKILL.md).
- Boundary markers: The instructions provide procedural boundaries by directing the agent to 'treat [input] as claims until corroborated' (SKILL.md), though no technical delimiters are defined to separate user input from system instructions.
- Capability inventory: The agent can send emails, archive threads using
customer-email-draft-threads, and modify Codex tasks (SKILL.md). - Sanitization: The skill does not mention technical sanitization or validation of the untrusted text before it is used in decision-making or drafted into replies.
Audit Metadata