persona-sdk-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a client for interacting with the Persona API, which fetches identity verification and inquiry data. This external data source introduces an ingestion surface for indirect prompt injection if an attacker can control the content of verification fields.
- Ingestion points: Data enters the agent context through the
createInquiry,getInquiry,listInquiries, andgetVerificationmethods in thePersonaClientclass inSKILL.md. - Boundary markers: The provided code snippets do not include boundary markers or explicit instructions for the agent to ignore instructions embedded in the API data.
- Capability inventory: The skill allows the use of
Read,Write, andEdittools, creating a potential risk if malicious instructions in the API data are executed by the agent. - Sanitization: The implementation lacks logic to sanitize, validate, or filter the content of API responses before they are processed by the agent.
Audit Metadata