anfrage-eingang-parser
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources (incoming client emails). While this represents a potential surface for indirect prompt injection where an attacker could embed malicious instructions in an inquiry, the skill's restricted scope mitigates the risk.
- Ingestion points: Incoming emails from various channels (E-Mail, Webformular, beA, Messenger) as defined in the 'Triage zu Beginn' section of SKILL.md.
- Boundary markers: The instructions include explicit constraints such as 'Keine Interpretation über den Wortlaut hinaus' (no interpretation beyond wording) and 'Sachverhaltsfetzen sind Zitate' (fact snippets are quotes), which act as logical boundaries to prevent the AI from following embedded commands.
- Capability inventory: The skill does not call any high-risk tools such as shell execution, dynamic code evaluation, or external network writes to non-whitelisted domains.
- Sanitization: The skill lacks explicit technical sanitization or escaping for the processed email content, relying instead on the AI's instructional alignment to remain within the extraction schema.
Audit Metadata