persona-sdk-patterns

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a client for interacting with the Persona API, which fetches identity verification and inquiry data. This external data source introduces an ingestion surface for indirect prompt injection if an attacker can control the content of verification fields.
  • Ingestion points: Data enters the agent context through the createInquiry, getInquiry, listInquiries, and getVerification methods in the PersonaClient class in SKILL.md.
  • Boundary markers: The provided code snippets do not include boundary markers or explicit instructions for the agent to ignore instructions embedded in the API data.
  • Capability inventory: The skill allows the use of Read, Write, and Edit tools, creating a potential risk if malicious instructions in the API data are executed by the agent.
  • Sanitization: The implementation lacks logic to sanitize, validate, or filter the content of API responses before they are processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 03:36 PM
Security Audit — agent-trust-hub — persona-sdk-patterns