gpt-pro-collab
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with the ChatGPT web interface, which creates a surface for indirect prompt injection where instructions from the external model could attempt to influence the agent's behavior.
- Ingestion points: The skill reads the DOM and message history from chatgpt.com via a built-in browser (SKILL.md).
- Boundary markers: Instructions explicitly direct the agent to ignore any instructions within the browser page that request credentials, privilege escalation, or unauthorized actions (SKILL.md).
- Capability inventory: The skill allows file system read/write in the local repository, shell command execution for testing, and browser management (SKILL.md).
- Sanitization: The agent is required to manually review all code provided by the external source and verify it using local test suites before final integration (SKILL.md).
- [DATA_EXFILTRATION]: The skill is designed to package and upload local repository content to a third-party service (OpenAI).
- Evidence: The workflow involves creating ZIP archives of source code files to provide context for the external ChatGPT model (SKILL.md).
- Mitigation: A robust list of exclusions is enforced, specifically prohibiting the inclusion of .git directories, .env files, API keys, tokens, and private keys to prevent accidental secret exposure (SKILL.md).
- [COMMAND_EXECUTION]: The skill automates the execution of local development and build tools on code integrated from the external advisor.
- Evidence: The agent is instructed to run linting, type checks, unit tests, and build commands within the local project environment to validate integrated code changes (SKILL.md).
Audit Metadata