outlook-pre-onboarding-checklist-meeting
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill is configured to ingest and process data from an external source (Docusign workflow context) to perform automated actions, which may present a surface for indirect influence if the source data is manipulated.
- Ingestion points: Data such as 'Employee Full Name' and agreement 'Effective Date' enter the agent's context through the Docusign workflow trigger in
SKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the interpolated data, which is a common practice to help delineate untrusted content.
- Capability inventory: The skill utilizes the
Work IQ Calendar (Preview)tool to create calendar events, demonstrating a capability to act on the processed data. - Sanitization: There are no explicit instructions for validating or escaping the 'Employee Full Name' string before it is incorporated into the meeting subject.
Audit Metadata