cms-stale-content-refresh
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content fetched from an external CMS, creating a potential surface for indirect prompt injection attacks.
- Ingestion points: Data is ingested via
cms_list_articlesandcms_get_article(Step 2 and Step 4 of the workflow). - Boundary markers: The instructions do not define delimiters or specific boundary markers to isolate article content from the agent's instructions.
- Capability inventory: While the skill itself is constrained to
READ_ONLYoperations and recommendation tasks, it explicitly suggests follow-up actions involving other skills (likecms-article-publish) that have write capabilities. - Sanitization: There is no evidence of sanitization or filtering applied to the article text retrieved from the CMS before it is processed by the agent.
Audit Metadata