search
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill's architecture creates a surface for indirect prompt injection by design. It instructs the agent to ingest, decompose, and synthesize data from potentially untrusted external sources.
- Ingestion points: Data enters the agent context from external MCP-connected sources including chat platforms, email, cloud storage, project trackers, and CRMs (SKILL.md, Section 1 and 3).
- Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" headers to be used when presenting retrieved content to the LLM, increasing the risk that the agent may follow instructions found within searched documents.
- Capability inventory: The skill utilizes search and read tools across multiple domains (chat, email, files, tasks). While the skill doesn't perform outbound network requests or file writes itself, the summarized data is passed back to the agent which may have those capabilities.
- Sanitization: No instructions are provided for sanitizing, escaping, or validating the content retrieved from external sources before it is synthesized into a response.
Audit Metadata