churn-risk-detector
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data from customer communications which could contain malicious instructions.
- Ingestion points: Support ticket exports, Slack channel history, and NPS survey comments (SKILL.md Phase 0 and 1).
- Boundary markers: The instructions do not define boundary markers or clear delimiters to separate data from instructions.
- Capability inventory: The skill has the capability to write risk reports to the file system (SKILL.md Phase 4).
- Sanitization: There is no evidence of sanitization or filtering of the ingested communication data before it is processed by the agent.
- [DATA_EXPOSURE]: The skill requires access to highly sensitive business and customer information.
- Sensitive Data Types: The intake process requests contract values (MRR/ARR), customer email addresses, billing data (payment failures, downgrades), and private Slack/email communication logs.
- Access Patterns: It accesses and generates files within a client-specific directory structure (
clients/<client-name>/customer-success/churn-risk/). - [PERSISTENCE]: The skill includes instructions to establish periodic execution, which functions as a persistence mechanism.
- Evidence: The 'Scheduling' section in SKILL.md provides a crontab entry (
0 8 * * 1 python3 run_skill.py ...) to ensure the skill runs automatically every Monday morning.
Audit Metadata