workiq-copilot
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill enables the agent to fetch and process untrusted external data from Microsoft 365 sources, presenting an indirect prompt injection attack surface.\n
- Ingestion points: Microsoft 365 data including emails, documents, meetings, and Teams messages enter the context via
workiq askas outlined inSKILL.md.\n - Boundary markers: Absent. The instructions lack specifications for delimiters or safety guidelines to ignore embedded instructions within the retrieved content.\n
- Capability inventory: Executes local shell commands (
workiq ask) and hosts an MCP server (workiq mcp) as detailed inSKILL.md.\n - Sanitization: Absent. No filtering or escaping mechanisms are specified for the incoming text data.\n- [EXTERNAL_DOWNLOADS]: The skill documents the installation of external components.\n
- Evidence: References installing
@microsoft/workiqvia npm and plugins via GitHub copilot-plugins repositories. These dependencies belong to well-known technology services and platforms.
Audit Metadata