subscription-billing-reconciliation
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process data from potentially untrusted external sources, which could contain malicious instructions.
- Ingestion points: The instructions specify reading 'rule sources' including memos, chat logs, and READMEs (Step 1), as well as 'invoice exports' (Step 3) and 'customer names' (Step 4).
- Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within these external sources.
- Capability inventory: The skill itself contains no scripts or code; however, the agent using these instructions may have file-write or subprocess capabilities that could be targeted.
- Sanitization: The skill recommends name normalization (Step 4) but lacks logic for sanitizing or filtering instructions embedded in processed prose.
- Contextual risk: The logic that 'Later messages override earlier ones' (Step 1) specifically increases the risk of injection by allowing an attacker to override previous rules with a final malicious message.
- [NO_CODE]: The skill consists of documentation and instructions but does not include any executable scripts, binaries, or automated code files.
Audit Metadata