pipa-requirements-brief
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from untrusted external environments (e.g., chat logs, tickets, and cloud documents) which constitutes a surface for indirect prompt injection attacks.
- Ingestion points: Data is pulled from Slack, Notion, Drive, and Linear via tool calls (SKILL.md, evals.json).
- Boundary markers: The instructions mandate the separation of source facts from inferred requirements and the use of explicit status labels (e.g.,
used,partial,stale) to maintain data integrity. - Capability inventory: The skill possesses read/write capabilities for external workspace tools managed through
composio-mcp. - Sanitization: A critical mitigation is implemented through a mandatory human-in-the-loop (HITL) gate, requiring explicit user approval for any external write operation after showing the scoped changes.
- [DATA_EXPOSURE]: The skill reads local configuration files stored in the user's home directory (
~/.pipa/communication-style.mdand~/.pipa/CONNECTORS.md). This is a standard pattern for managing application-specific settings and connector preferences and does not represent a security risk.
Audit Metadata