two-tier-extraction
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process large volumes of untrusted third-party data, such as email archives and document dumps. This creates an attack surface where malicious instructions hidden in the processed data could attempt to override agent instructions.
- Ingestion points: Processes bulk content from source directories and archives for extraction.
- Boundary markers: The skill references an 'untrusted-content' convention and utilizes the 'untrusted-quoted' fence to distinguish data from instructions.
- Capability inventory: The skill is configured to write files to various local directories including 'originals/', 'personal/', and 'people/'.
- Sanitization: A 'Step 0' deterministic privacy wall is implemented to strip named entities and sensitive patterns (credentials, medical terms) from raw content before any LLM processing occurs.
Audit Metadata