shop-push-broadcast
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a strictly ordered workflow with a mandatory 'Explicit confirmation' step before performing the sensitive action of sending a push broadcast to all shop users.
- [SAFE]: Guardrails are in place to prevent automatic sends, empty messages, or placeholder content (e.g., 'test', 'lorem').
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from product and CMS catalogs, creating a potential surface for indirect prompt injection if external metadata contains malicious instructions.
- Ingestion points: Tool outputs from
shop_list_products,cms_list_cms_sections, andcms_list_sections(SKILL.md). - Boundary markers: No explicit XML/markdown delimiters are used to wrap ingested data, but the skill requires a specific structured output format.
- Capability inventory: Sending push notifications to the entire registered user base via
shop_create_push_broadcast(SKILL.md). - Sanitization: The skill includes mandatory spellchecking, character limit enforcement (<= 255 chars), and a hard requirement for explicit user confirmation ('Confirm send?') before the final tool call, which effectively mitigates the risk of unintended broadcasts triggered by data injection.
Audit Metadata