education-cloud-course-catalog-migrate
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources including PDF documents, CSV files, and website URLs provided by the user.
- Ingestion points: Data is ingested via the
WebFetchtool for website URLs and theReadtool for PDF and CSV files. - Boundary markers: The skill lacks explicit instructions for the agent to ignore potential instructions embedded within the ingested course descriptions or catalog text.
- Capability inventory: The skill has capabilities to perform Salesforce record writes via the Composite REST API and execute local Python scripts.
- Sanitization: External data is passed through local Python scripts (
scripts/split_course_code.py,scripts/detect_linked_courses.py) using JSON via stdin, which provides structural isolation. However, there is no explicit sanitization of the text content against prompt injection before it is processed by the agent. - [COMMAND_EXECUTION]: The skill executes local Python scripts to perform data transformations and validations.
- Evidence: The workflow invokes
python3forscripts/resolve_api_version.py,scripts/validate_completeness.py,scripts/detect_linked_courses.py,scripts/batch_courses.py, andscripts/split_course_code.py. - Context: These scripts use standard library modules (json, sys, re, argparse) and operate on data provided through pipes, representing standard helper functionality rather than a security risk.
Audit Metadata