cowork-deal-room
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted documents (PDFs, .docx, .xlsx, .csv) from a user-provided directory, creating a surface for indirect prompt injection attacks.
- Ingestion points: Untrusted data enters the agent context in Phase 1 (Inventory) and Phase 2 (Legal Analysis) via the
Readtool as described inreferences/phase-procedures.md. - Boundary markers: The instructions lack explicit boundary markers or instructions to the LLM to ignore embedded commands within the analyzed documents.
- Capability inventory: The skill utilizes powerful tools including
Bash,Write, andWebSearch, which could be abused if an attacker-controlled document successfully influences agent behavior. - Sanitization: There is no evidence of content sanitization or validation of the text extracted from documents before it is processed by the model.
Audit Metadata