support-lead
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process web content and external data via the BrowserOS tool, which introduces a potential surface for indirect prompt injection attacks. While the instructions explicitly mandate treating this data as hostile and redacting PII, the ingestion point remains an inherent risk factor for the agent's logic.
- Ingestion points: External data and web content accessed via the BrowserOS interface.
- Boundary markers: The protocol instructions mention treating external data as hostile but do not provide specific delimiter-based boundary markers or instructions to ignore embedded commands within the ingested text.
- Capability inventory: The skill has access to the IssueTracker Interface, ExecutionProxy Interface (allowing terminal execution like npm commands), and the MemoryStore Interface for writing persistent markdown artifacts to local storage.
- Sanitization: The instructions require redacting secrets and PII before sharing context with subagents, providing a layer of protection against accidental data leakage.
Audit Metadata