spark-persona-support-agent
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating an attack surface where embedded instructions could influence the agent's behavior.
- Ingestion points: The skill reads full email threads using the
spark thread <id>command as part of its primary workflow. - Boundary markers: The instructions do not specify any boundary markers (e.g., delimiters) or warnings to ignore instructions embedded within the processed email content.
- Capability inventory: The agent has the capability to draft replies (
spark draft), assign tasks to specific users (spark action assign), leave internal comments (spark comment), and block or accept contacts (spark contact-action). - Sanitization: There is no evidence of sanitization or validation of the email content before it is processed or used to generate replies and comments.
Audit Metadata