list-segment-builder
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as scraped text, customer reviews, and third-party exports, creating an indirect prompt injection surface. The SKILL.md and references/skill-contract.md files include strong mitigations by instructing the agent to treat these inputs solely as evidence and never as instructions. Evidence chain: 1. Ingestion points: Data sources include scraped page text, reviews, and CRM exports defined in SKILL.md and references/connectors.md. 2. Boundary markers: Instructions explicitly require labeling consequential claims (measured/user-provided) and treating scraped material as untrusted input. 3. Capability inventory: The skill reads project files and uses connectors (e.g., GA4, HubSpot) but defaults to read-only/dry-run behavior. 4. Sanitization: There is a mandatory directive to ignore embedded instructions from evidence.
Audit Metadata