apply-sop-writer
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted user-provided content while maintaining active tool capabilities.
- Ingestion points: The skill extracts context from user-provided drafts, research experience, and technical preparation to generate reviews and plans (SKILL.md).
- Boundary markers: There are no specific instructions or delimiters provided to the agent to distinguish between its core instructions and potentially malicious instructions embedded within the user's essay drafts.
- Capability inventory: The skill explicitly directs the agent to "search the web for the live official programme page" (SKILL.md, Step 3), which involves transmitting program names (potentially derived from user input) to a search engine tool.
- Sanitization: The instructions do not include steps to sanitize or validate user-provided data before it is incorporated into the search queries or the resulting output documents.
Audit Metadata