ticket-deflector
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from customer emails and messages, which could contain malicious instructions designed to influence agent behavior (SKILL.md, Step 1).
- Ingestion points: Customer communications received via email, messenger, or manual text entry (SKILL.md, Step 1).
- Boundary markers: While no explicit character-based delimiters are used for the input text, the skill mandates a clear separation between the data ingestion and the action execution phases.
- Capability inventory: The skill utilizes tools for processing refunds (
~~платежи), updating customer notes (~~crm), and sending external communications (~~почта,~~мессенджер). - Sanitization: Security is maintained via strict human-in-the-loop (HITL) approval gates. Step 5 requires the owner to approve any response draft, and Step 6 requires an explicit "Yes" confirmation before a refund is executed, preventing automated exploitation of potential injections.
- [SAFE]: The skill adheres to security best practices by requiring explicit user confirmation for high-stakes actions, such as financial transactions and external communication. It also avoids providing unverifiable legal advice and mandates transparency regarding missing data in drafts.
Audit Metadata