icp-research
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the
uploads/directory, including customer lists and interview notes. While this represents an attack surface for indirect prompt injection, the risk is mitigated by the skill's lack of high-privilege capabilities and the model's internal safety guardrails. - Ingestion points: User-provided CSVs and notes loaded from the
uploads/directory. - Boundary markers: The skill does not implement explicit delimiters or warnings to ignore instructions embedded in the source data.
- Capability inventory: The skill is limited to writing markdown files to the
knowledge/andoutput/directories. It has no capabilities for network access, subprocess execution, or dynamic code evaluation. - Sanitization: No specific content filtering or escaping is applied to the ingested data.
- [SAFE]: The skill's primary function is data processing and knowledge management. It adheres to the principle of least privilege by restricting its file system access to specific project directories and avoids all high-risk operations such as remote code execution or credential handling.
Audit Metadata