qonto-counterparty-watch
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could serve as a vector for indirect prompt injection.
- Ingestion points: Data is ingested through
list_transactions(bank labels),list_clients(client names/tax IDs), andlist_supplier_invoices(supplier names). - Boundary markers: The instructions do not specify explicit boundary markers or delimiters when processing transaction labels or names during the 'Name normalization' phase.
- Capability inventory: The skill only has access to read-only tools (
mcp:datagouv,mcp:qonto) and theReadtool. It lacks file-write, shell execution, or arbitrary network capabilities, significantly limiting the impact of any potential injection. - Sanitization: The skill performs basic normalization (uppercasing, stripping suffixes) which provides structural cleanup but does not sanitize against semantic prompt injection instructions embedded in labels.
Audit Metadata