attribution
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze untrusted external data, such as self-reported survey responses and webhook payloads, which can serve as a vector for indirect prompt injection. \n
- Ingestion points: Free-text survey responses ('How did you hear about us?') and metadata smuggled through third-party domains (SavvyCal, Calendly, Stripe) as described in
SKILL.md(Section 4) andreferences/first-party-tracking.md(Step 2). \n - Boundary markers: While the skill provides architectural security advice like PII guards and webhook verification in
references/first-party-tracking.md(Step 3), it does not include instructions for the agent to disregard or escape embedded commands within the processed marketing data. \n - Capability inventory: The agent generates 'Attribution Readouts' in
SKILL.mdand is tasked with reconciling data across multiple platforms and syncing values to CRM fields inreferences/first-party-tracking.md(Step 5), providing a path for injected instructions to influence report output or CRM records. \n - Sanitization: The skill provides implementation logic to sanitize identifiers (email normalization and ID length checks) in
references/first-party-tracking.md, but lacks natural language sanitization for the open-ended survey inputs it processes.
Audit Metadata