pipa-risk-escalation
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXPOSURE]: The skill is configured to read specific files from the user's home directory to determine communication styles and tool preferences.
- Evidence: Accesses
~/.pipa/communication-style.mdand~/.pipa/CONNECTORS.mdto guide its internal logic and presentation layer. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and synthesize data from external, potentially untrusted sources which could contain malicious instructions.
- Ingestion points: Processes data from Jira risk snapshots, Slack messages, Notion decision records, Linear RAID queries, and tracker states (found in
SKILL.mdandevals/evals.json). - Boundary markers: The instructions do not specify the use of delimiters or clear separation between the ingested external data and the agent's core instructions.
- Capability inventory: The skill has the capability to perform external writes or sends, though it includes a safeguard requiring explicit human approval before any write action (found in
SKILL.md). - Sanitization: There is no evidence of data sanitization or validation logic to ensure that ingested text from blockers or comments does not override the skill's workflow logic.
Audit Metadata