persona-team-lead
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data and interacts with multiple workspace tools, introducing an indirect prompt injection surface.
- Ingestion points: The skill ingests untrusted external email content using the
gws workflow +email-to-taskcommand specified inSKILL.md. - Boundary markers: There are no explicit prompt boundary markers or instruction-isolation definitions described in the workflow instructions to segregate text content from instructions.
- Capability inventory: The skill possesses extensive capabilities including appending to spreadsheets (
gws sheets +append), sending chat messages (gws chat spaces messages create), and triggering automated workflows through thegwstool. - Sanitization: The tips section recommends utilizing a
--sanitizeflag for workflows involving sensitive data, which provides partial mitigation for data exposure, though its impact on malicious instruction parsing depends on the underlying binary's implementation.
Audit Metadata