internal-source-research
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting data from external platforms (Notion, Slack, GitHub, Linear), which inherently presents an indirect prompt injection surface. However, the skill includes comprehensive mitigations.
- Ingestion points: External data enters the context from Notion pages, Slack threads, GitHub issues/PRs, and Linear tickets as described in
SKILL.md. - Boundary markers: The skill provides explicit instructions to the agent to treat all retrieved content, including instructions embedded within that content, as evidence to be analyzed rather than as authority to widen the task scope or take external actions.
- Capability inventory: The skill utilizes read-only tools for content retrieval and allows for task delegation to subagents under a bounded research frame.
- Sanitization: The skill mandates data minimization and the redaction of sensitive identifiers from output, as detailed in
references/source-access-and-scope.md. - [SAFE]: The skill contains strong defensive patterns against data exfiltration and credential exposure, explicitly forbidding the dumping of workspaces, the sweeping of direct messages without authorization, and the storage of credentials within the skill itself.
Audit Metadata