customer-ops-specialist
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process untrusted data from customers, such as support ticket descriptions and billing disputes, which creates an attack surface for indirect prompt injection.
- Ingestion points: The 'Ticket triage' and 'Billing operations' workflows in
SKILL.mdandreferences/support_operations.mdrequire the agent to read and act upon customer-submitted content. - Boundary markers: There are no instructions in the skill files to wrap external customer content in specific delimiters or to warn the agent to ignore any instructions embedded within that data.
- Capability inventory: The workflows suggest actions such as 'updates customer record' and 'investigates charge', implying the agent will use platform tools to interact with sensitive databases or external APIs based on the content of the tickets.
- Sanitization: The skill lacks guidelines for sanitizing or escaping customer-supplied text before the agent processes it.
- [NO_CODE]: The skill is composed exclusively of Markdown documentation, business templates, and workflow descriptions. It does not include any scripts (Python, Node.js), binaries, or shell commands, significantly limiting its direct execution risk.
Audit Metadata