chat-mention-triage
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as its primary function involves ingesting and processing untrusted data from chat environments.
- Ingestion points: The skill reads team-chat messages, threads, attachments, and linked pages (SKILL.md).
- Boundary markers: Instructions explicitly require the use of
<EXTERNAL_DATA>delimiters for retrieved material and include directives to ignore embedded requests to run tools or change policies. - Capability inventory: The agent is authorized to read chat history, fetch linked URLs, and create or update task/decision records.
- Sanitization: The skill mandates structured extraction with schema validation, SSRF protections (rejecting loopback/private network destinations), and caps on content size and parsing depth.
Audit Metadata