remofirst-core-workflow-a
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates a surface for indirect prompt injection by ingesting data from external API endpoints.
- Ingestion points: External data enters the context via
client.getcalls in Step 2 (/countries/GB/requirements) and Step 4 (/employees/{id}/onboarding). - Boundary markers: The instructions lack delimiters or explicit warnings to the agent to ignore potentially malicious instructions embedded in the API responses.
- Capability inventory: The skill environment is configured with
Bash(npm:*),Bash(curl:*),Write, andEdittools as specified in the frontmatter. - Sanitization: There is no evidence of data sanitization or validation for the content received from the API before it is processed by the agent.
- [DATA_EXFILTRATION]: The workflow for submitting onboarding documents includes an example network operation to a non-whitelisted domain (
secure-storage.com). While intended as a placeholder, this pattern involves sending references to potentially sensitive documents to an external service.
Audit Metadata