notis-automation
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process data from external sources to trigger automated agent actions, creating a potential surface for indirect injection if external sources are compromised.
- Ingestion points: External data enters the agent context via webhooks (references/webhook.md), app integrations like Gmail (references/integration.md), and database record changes (references/database.md).
- Boundary markers: The skill does not explicitly require the use of delimiters or instructions to ignore embedded commands within the processed data payloads.
- Capability inventory: Automations execute agent prompts that can invoke various internal tools (LOCAL_NOTIS_*) and reference external skills, potentially allowing untrusted data to influence subsequent tool calls.
- Sanitization: There are no instructions for sanitizing, escaping, or validating the content of external triggers before they are interpolated into the automation prompts.
Audit Metadata