education-cloud-course-catalog-migrate
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external URLs, CSVs, and PDF documents, which creates an attack surface for indirect prompt injection where adversarial instructions embedded in the source data could influence agent behavior.
- Ingestion points: The skill retrieves course catalog data from primary sources (CSV, PDF, or website URLs via
WebFetch) as described inSKILL.md(Phase 1). - Boundary markers: The instructions do not specify explicit delimiters or "ignore embedded instructions" warnings for the ingested content, though the workflow includes multiple manual confirmation steps.
- Capability inventory: The agent has access to
WebFetch,Read(file access), and the Salesforce REST API (POST,PATCH,GET) for record management and data retrieval. - Sanitization: The skill uses specific local Python scripts (e.g.,
validate_completeness.py,batch_courses.py) to parse and transform data into structured JSON, which significantly reduces the risk of the LLM directly executing embedded text instructions. - [COMMAND_EXECUTION]: The skill instructs the agent to execute multiple local Python scripts for data processing and validation.
- Evidence: The workflow utilizes commands such as
python3 scripts/validate_completeness.py,python3 scripts/detect_linked_courses.py, andpython3 scripts/batch_courses.pyvia the shell to handle internal course data logic and batching.
Audit Metadata