win-back
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from a deal database (JSON) and interpolates it into email templates. If fields like 'title' or 'name' contain malicious instructions, they could influence the agent's behavior during the drafting process.\n
- Ingestion points: Data is loaded from a JSON file (defaulting to a path defined in an external module) and from a temporary text file (/tmp/w.txt) during record operations.\n
- Boundary markers: The email templates do not use delimiters or guardrail instructions to prevent the agent from obeying commands embedded in the data fields.\n
- Capability inventory: The skill can read/write files and execute logic to generate drafts, but it requires a user 'yes' before final actions are taken.\n
- Sanitization: The skill lacks sanitization for data fields before they are interpolated into the prompt templates.\n- [DYNAMIC_EXECUTION]: The script winback.py dynamically loads the closer_deals module from a neighboring directory (../pipeline/deals.py) using importlib.util. While this is a fixed path used for modularity, it allows the skill to execute logic defined outside its own folder boundary.
Audit Metadata