personal-crm
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest data from external meeting recorders (e.g., Granola, Fireflies, Fathom) and process transcripts into dossier notes. This creates a surface where malicious instructions embedded in a meeting transcript could influence the agent's behavior during the normalization and extraction process.
- Ingestion points: Meeting notes and verbatim transcripts are pulled from external meeting-recorder MCPs and written to the
meetings/directory (SKILL.md). - Boundary markers: The skill defines a
--- timeline ---separator for dossier files and a specific dated-bullet format, which helps structure data but does not provide security isolation for untrusted content. - Capability inventory: The agent uses the
write()tool to create and update dossier files and interacts with various registered MCP servers for data retrieval. - Sanitization: The instructions emphasize verbatim recording of transcripts and extraction of entities but do not specify sanitization or filtering of the external content to prevent command or prompt injection.
Audit Metadata