glean-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process and index external document content, which creates a potential attack surface where instructions embedded in those documents could influence the agent's behavior.\n
- Ingestion points: The
allDocsarray inSKILL.md(Step 2) acts as the primary entry point for untrusted document data being processed for indexing.\n - Boundary markers: The code snippets provided do not implement explicit delimiters or instructions for the agent to ignore potentially malicious commands embedded within the
doc.contentfield.\n - Capability inventory: The skill environment grants the agent network access via
fetchandBash(curl), and file system management capabilities viaRead,Write, andEdittools.\n - Sanitization: The skill includes a specific instructional constraint in the Output section to never include document bodies or credentials in responses, which serves as a prompt-level safety measure, though no programmatic sanitization of the input documents is shown in the logic.
Audit Metadata