surface-insight
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided data, observations, and notes to surface insights. This represents a potential surface for indirect prompt injection if malicious instructions were embedded in the user's data. However, the skill lacks any functional capabilities—such as file writing, network access, or command execution—that could be leveraged by such an injection. Furthermore, the skill's "Grounding Rule" mandates that the AI strictly cite and quote provided data points, which creates a logical boundary that encourages the model to treat the input as passive data rather than active instructions.
- [NO_CODE]: The skill is composed entirely of markdown instructions and does not include any scripts, executables, or configuration files that could carry out malicious actions on a host system.
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data access techniques were detected. The skill's instructions are focused on analytical reasoning and follow best practices for data integrity and transparency.
Audit Metadata