spark-persona-exec-assistant
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes untrusted content from external emails and contacts.
- Ingestion points: Untrusted data enters the agent context through
spark emails,spark thread, andspark searchcommands inSKILL.md. - Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between system instructions and data contained within email bodies.
- Capability inventory: The skill allows the agent to draft replies (
spark draft) and view calendar events (spark events,spark availability), which could be misused if an attacker sends an email with embedded instructions that the agent follows. - Sanitization: The instructions do not include steps to sanitize, filter, or validate the content of emails before the agent acts upon them.
Audit Metadata