make-api-shell-connection-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a standard operating framework for provisioning and executing Make.com API shells to retrieve external SaaS platform records, establishing an inherent indirect prompt injection vulnerability surface.
- Ingestion points: External data enters the agent context during Phase B retrieval operations as detailed in
SKILL.mdandretrieval-execution.md(e.g., reading unread emails, pulling CRM leads, fetching Jira tickets, and extracting Slack channel message history via/conversations.history). - Boundary markers: The instructions lack explicit guidelines for employing defensive formatting or isolation delimiters (such as enclosing data in strict XML/markdown blocks or instructing the model to disregard instructions contained within the payloads) when the model processes the retrieved text.
- Capability inventory: The skill interacts extensively with the Make REST API across multiple files, utilizing powerful capabilities including creating scenarios (
POST /api/v2/scenarios), deploying interfaces, creating keychains (POST /api/v2/keys), and initiating interactive scenario executions (POST /api/v2/scenarios/{scenarioId}/run) that can issue arbitrary external network requests via thehttp:MakeRequestutility. - Sanitization: Although
sanitization-and-sharing.mdoutlines procedures for sanitizing structural blueprints and logs by scrubbing workspace identifiers (such asTEAM_IDandORG_ID) before public sharing, no validation, escaping, or defensive sanitization logic is implemented for the text data gathered at runtime.
Audit Metadata