qonto-carbon-ledger
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external APIs (Datagouv) and user-controllable transaction labels/descriptions which serve as a surface for indirect prompt injection attacks.
- Ingestion points: Data enters the agent context via
datagouvdataset searches and results, as well aslist_transactionsandlist_labelsfrom Qonto, which contain user-provided text. - Boundary markers: The skill includes a specific "Datagouv data boundary" instruction that explicitly tells the agent to treat external results as reference data only and to ignore any embedded instructions to exfiltrate data or change the workflow.
- Capability inventory: The skill utilizes the
Writetool to generate local HTML dashboards and has access to sensitive financial information via theqontoMCP tools. - Sanitization: While the skill provides clear instructions to ignore external commands (a protective prompt boundary), it lacks technical sanitization or schema validation for the free-text fields it processes.
Audit Metadata