instantly-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection because it ingests data from external websites and local files to drive file modifications within the repository.
- Ingestion points: The skill uses
Read,Glob, andGrepto analyze repository content andWebFetchto retrieve data from external Instantly documentation sites (SKILL.md, references/official-docs.md). - Boundary markers: There are no explicit technical boundary markers or delimiters defined to isolate the ingested content from the agent's core instructions.
- Capability inventory: The skill allows the use of
WriteandEdittools, enabling the agent to modify the repository based on potentially manipulated inputs. - Sanitization: The skill provides procedural instructions to redact sensitive fields and avoid writing credentials to the filesystem, serving as a best-practice guideline rather than a technical enforcement.
Audit Metadata