qonto-supplier-detective
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the Qonto API, including supplier names, transaction labels, and invoice numbers, which could be used as an attack surface for indirect prompt injection.
- Ingestion points: Supplier invoices and transaction data retrieved via
list_supplier_invoicesandlist_transactionsinSKILL.md. - Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded prompts within the retrieved data.
- Capability inventory: The skill is highly restricted with only read-only access to the Qonto MCP and no permissions for network communication or file system writes.
- Sanitization: String normalization is applied to supplier names (stripping legal suffixes) and invoice numbers, providing a baseline level of data cleaning though not dedicated prompt sanitization.
- [DATA_EXPOSURE]: The skill handles sensitive financial data but implements specific mitigation strategies.
- Evidence: The instructions explicitly require masking IBANs (showing only the last 4 digits) and limit tool usage to a read-only forensic sweep.
- Context: No network tools are requested in the YAML frontmatter, ensuring that the audited data remains within the agent's current session.
Audit Metadata