product-content-enrichment
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill constructs LLM prompts by directly interpolating external and potentially untrusted product information into string templates.
- Ingestion points: Data enters the agent's context through bulk CSV imports (Step 2 in
SKILL.md) and database objects passed to the enrichment functions (e.g., theproductobject inlib/productEnrichment.ts). - Boundary markers: While the prompts use simple labels like 'Product:' and 'Attributes:', they lack robust delimiters or specific instructions for the model to disregard instructions that might be embedded within the product data itself.
- Capability inventory: The skill uses the
@anthropic-ai/sdkto perform content generation and has the capability to write to the database (db.productEnrichmentDrafts.upsertanddb.products.update). - Sanitization: There is no evidence of sanitization, escaping, or validation of the product variables (
{name},{attributes}, etc.) before they are merged into the prompt, creating a surface for indirect injection attacks.
Audit Metadata