customer-research
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection due to its core functionality of ingesting and analyzing untrusted external content.
- Ingestion points: The skill is instructed to read raw, user-provided materials (call transcripts, support tickets, survey responses) and fetch public content from the web (Reddit, forums, review sites) using
WebSearchandWebFetchtools. - Boundary markers: There are no specific instructions or delimiters provided to isolate untrusted content or warn the agent to ignore instructions embedded within the processed text.
- Capability inventory: The skill possesses write access to the internal knowledge base (
knowledge/icp/personas.md) and the project's output directory, meaning poisoned data could corrupt persistent project documentation. - Sanitization: The instructions lack any requirement for the agent to sanitize or validate the external data before interpolating it into the persona templates or knowledge base files.
Audit Metadata