process-inbox
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingest content from unprocessed markdown notes to determine routing decisions and metadata updates.
- Ingestion points: The skill iterates through and reads all files in the inbox that have the frontmatter
processed: false(SKILL.md). - Boundary markers: Absent. There are no specified delimiters or 'ignore' instructions provided to the agent to prevent it from obeying commands embedded within the notes.
- Capability inventory: The agent is empowered to delete files, archive files, move notes to different directories, and update project outcome statuses (SKILL.md).
- Sanitization: Absent. No validation or filtering is performed on the note content before it influences the agent's routing logic.
- [SAFE]: The skill implements a 'secretary' role (defined in ROLE.md) that explicitly limits the agent's autonomy, requiring an explicit 'grant' for scoped actions and prohibiting unilateral implementation work.
- [SAFE]: A human-in-the-loop checkpoint is enforced for 'ambiguous bulk moves,' requiring the agent to wait for user confirmation before proceeding (SKILL.md).
Audit Metadata