internal-comms
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to ingest content from external, untrusted sources which creates a surface for indirect prompt injection attacks.
- Ingestion points: The instructions guide the agent to pull data from Slack messages, company emails, Google Drive documents, and external press releases (examples/3p-updates.md, examples/company-newsletter.md, examples/faq-answers.md).
- Boundary markers: There are no requirements for delimiters or instructions to ignore potential commands embedded within the retrieved data.
- Capability inventory: The agent uses the fetched information to generate newsletters, FAQs, and status reports that are distributed across the company.
- Sanitization: The skill lacks any description of sanitization, filtering, or validation logic for the external content before it is processed.
- [METADATA_POISONING]: There is a contradiction in the license metadata; the SKILL.md frontmatter lists the MIT License while the LICENSE.txt file contains the full text of the Apache License 2.0.
Audit Metadata