gamma-common-errors

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The Troubleshooting section suggests the use of echo $GAMMA_API_KEY to verify that the required environment variable is set. This command results in the sensitive API key being displayed in cleartext in terminal logs and session history.
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process external data, specifically "logs and error messages" from the Gamma API, which presents a surface for indirect prompt injection.
  • Ingestion points: The skill ingests API error responses and system logs as described in the Prerequisites and Error Reference sections.
  • Boundary markers: The skill provides instructions to return an "opaque correlation ID" and keep "private content, viewer details, and credentials out of evidence," which serves to separate sensitive data from the agent's output.
  • Capability inventory: The skill is configured with Read, Write, Edit, and Grep tools. It does not possess network access or arbitrary code execution capabilities, which limits the potential impact of an injection.
  • Sanitization: Explicit instructions are provided in the Output and Error Handling sections to sanitize output and exclude credentials, mitigating data exfiltration risks.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 07:05 AM