documenso-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled data such as recipient names, email addresses, and document field values, which creates a potential surface for indirect instructions to enter the workflow.
- Ingestion points: Untrusted data enters the context via the
recipients,prefillFields, andclientsvariables inSKILL.md, as well as the input interfaces defined inreferences/implementation-guide.md. - Boundary markers: The code examples do not demonstrate the use of delimiters or specific instructions to prevent the underlying model from interpreting data content as instructions.
- Capability inventory: The skill performs network requests to the Documenso API using
fetchand the@documenso/sdk-typescript, and accesses the local file system usingnode:fs.openAsBlobto read PDF files. - Sanitization: The implementation snippets do not include explicit validation or sanitization logic for the strings being interpolated into API request payloads.
Audit Metadata