gobi-onboarding
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from user-provided URLs and local documents to automate profile creation and knowledge base building.
- Ingestion points: The skill processes content from user-provided website URLs in step 1-1 and uploaded documents like PDFs, Word files, or EPUBs in step 1-2 to update the
BRAIN.mdprofile and create summaries. - Boundary markers: The instructions do not define explicit delimiters or security markers to ensure the agent ignores potentially malicious instructions embedded within the ingested web content or document files.
- Capability inventory: The skill has the capability to write to
BRAIN.mdat the vault root, modify the.gobi/syncfilesconfiguration for community sharing, and interact with background processing tasks (EIC, EDM, GDR, TIU) in the_Settings_/Tasks/directory. - Sanitization: No specific sanitization, filtering, or validation logic is documented for the content extracted from external URLs or documents before it is processed by the agent or saved to the knowledge base.
Audit Metadata