ai-agent-design
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents workflows for autonomous agents that process untrusted data from customers (e.g., 'Qual o status do meu pedido #12345?') and external systems (APIs, Vector Databases).
- Ingestion points: Customer messages in Workflow 1, API responses in the Webhook implementation, and search results from Vector Databases in Workflow 2 (SKILL.md).
- Boundary markers: The skill uses markdown headers like
<history>to delimit context, but these can be bypassed by sophisticated adversarial inputs. - Capability inventory: The skill defines high-privilege capabilities including database queries (
db_query_product), webhook execution for external logic (Make/N8N), and Jira ticket creation (create_jira_ticket) (SKILL.md). - Sanitization: There is no explicit instruction for the agent to sanitize or escape user-provided identifiers (like
order_idorcustomer_id) before they are passed to webhooks or database tools, which could lead to command or query injection at the tool level.
Audit Metadata