icp-deep-scanner
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a significant indirect prompt injection surface because its primary function involves the ingestion and synthesis of untrusted data from multiple external platforms.
- Ingestion points: The skill retrieves content from CRM systems (HubSpot, Salesforce), email/calendar logs, support tickets (Zendesk, Intercom), and public web content via
WebFetchandWebSearch. - Boundary markers: The instructions do not specify the use of delimiters (such as XML tags or triple backticks) or explicit directives to the agent to ignore instructions embedded within the source data.
- Capability inventory: The agent has access to powerful capabilities including
Write,Bash, andAgent, which could be leveraged if an attacker successfully injects instructions into a field analyzed by the skill (e.g., a support ticket or customer review). - Sanitization: While the instructions emphasize PII minimization and scrubbing identifying details, they lack any requirement to sanitize or escape control characters or potential instruction sequences in the ingested data.
Audit Metadata