Ops Cadence
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the Notion 'Inquiries' CRM and GitHub pull request descriptions/comments, which could contain malicious instructions designed to influence the agent's behavior during triage.
- Ingestion points: Ingests data from Notion CRM rows and GitHub PR metadata (SKILL.md).
- Boundary markers: The instructions do not specify explicit delimiters or 'ignore' instructions for the ingested content.
- Capability inventory: The skill has the capability to write back to Notion (updating stages) and prepare drafted replies for Slack or email via the Slack MCP.
- Sanitization: No explicit sanitization or filtering of the incoming data is mentioned.
- Mitigation: The skill explicitly implements a human-in-the-loop guardrail, stating 'Never auto-send a reply or advance a Won/Lost stage without Frank's confirmation', which significantly mitigates the risk of automated exploitation.
- [DATA_EXPOSURE]: The skill accesses sensitive business information including client inquiries, company names, and internal source code states. This access is scoped to the vendor's own GitHub organization (frankxai) and authorized Notion databases, which is appropriate for the skill's stated purpose as an operations loop.
Audit Metadata