qonto-grant-scout
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from bank transaction metadata (counterparty names, transaction labels, and descriptions) which could contain malicious instructions.
- Ingestion points: The
list_transactionsandlist_labelstools from the Qonto MCP are used to retrieve transaction history inSKILL.md. - Boundary markers: The instructions do not define specific delimiters for separating transaction data from system prompts, although they do include a 'Guardrails' section.
- Capability inventory: The skill is restricted to read-only tools (
get_organization,list_transactions,list_labels,search_datasets,get_dataset_info,query_resource_data). It lacks tools for file writing, network POST requests, or shell command execution. - Sanitization: The skill explicitly masks sensitive identifiers (last 4 digits of IBANs) and limits outgoing data to generic search keywords, but it does not specify sanitization or escaping for transaction text used in classification.
Audit Metadata