gamma-common-errors
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The Troubleshooting section suggests the use of
echo $GAMMA_API_KEYto verify that the required environment variable is set. This command results in the sensitive API key being displayed in cleartext in terminal logs and session history. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process external data, specifically "logs and error messages" from the Gamma API, which presents a surface for indirect prompt injection.
- Ingestion points: The skill ingests API error responses and system logs as described in the Prerequisites and Error Reference sections.
- Boundary markers: The skill provides instructions to return an "opaque correlation ID" and keep "private content, viewer details, and credentials out of evidence," which serves to separate sensitive data from the agent's output.
- Capability inventory: The skill is configured with
Read,Write,Edit, andGreptools. It does not possess network access or arbitrary code execution capabilities, which limits the potential impact of an injection. - Sanitization: Explicit instructions are provided in the Output and Error Handling sections to sanitize output and exclude credentials, mitigating data exfiltration risks.
Audit Metadata