doc-coauthoring
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process information from untrusted external sources, such as shared document links (Google Drive, SharePoint), team communication channels (Slack, Teams), and user-provided files. There are no explicit instructions to the agent to treat this data as untrusted or to use boundary markers, creating a potential surface for indirect prompt injection.\n
- Ingestion points: Shared document links, team channel threads, and user-uploaded templates or files (documented in Phase 1 of
SKILL.md).\n - Boundary markers: The skill lacks specific instructions for using delimiters or "ignore embedded instructions" warnings when processing external context.\n
- Capability inventory: File system access via
create_fileandstr_replacetools; integration capabilities with communication and storage platforms via MCP servers.\n - Sanitization: No sanitization, validation, or filtering logic is specified for the content imported from external links or integrations.\n- [COMMAND_EXECUTION]: The skill instructions utilize
create_fileandstr_replacetools for document management tasks. These operations are restricted to creating and modifying document artifacts in the user's environment, which aligns with the skill's documented purpose.\n- [EXTERNAL_DOWNLOADS]: The workflow describes fetching content from external services including Slack, Microsoft Teams, Google Drive, and SharePoint. These are recognized as well-known services, and the skill suggests using official connectors or MCP integrations for these operations.
Audit Metadata