handle-saas-billing-cases
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and process live customer email threads as the primary trigger for billing workflows. This creates a surface for indirect prompt injection attacks where a customer could include malicious instructions in an email to influence the agent's behavior.
- Ingestion points: The skill instructions in
SKILL.mdrequire the agent to 'Read the complete live customer thread' at the beginning of every case. - Boundary markers: The instructions lack clear delimiters or specific warnings for the agent to treat the customer email content strictly as untrusted data rather than instructional input.
- Capability inventory: The skill possesses high-privilege capabilities, including the ability to perform financial mutations (cancellations, refunds, voiding invoices) and use the
customer-email-draft-threadstool to send communications. - Sanitization: The instructions do not specify any sanitization or validation of the customer-provided content before the agent processes it for decision-making.
Audit Metadata