recoup-internal-consulting-integrations-sync
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple bundled Python scripts to perform data synchronization and archiving tasks.
- Evidence:
python3 integrations/granola/_work/pull_transcript.py,python integrations/gmail/_work/export_thread_bodies.py,integrations/slack/_work/list_access.py, andintegrations/slack/_work/pull_conversation.py. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external communication channels, including full email threads and Slack conversations.
- Ingestion points: Meeting transcripts (
integrations/granola/), email threads (integrations/gmail/), and Slack channel/thread history (integrations/slack/). - Boundary markers: Absent. While the instructions specify an "intake policy" and scoping rules, there are no explicit prompt delimiters or instructions for the agent to ignore potentially malicious content embedded in the ingested messages.
- Capability inventory: The skill can perform filesystem operations (moving folders, writing files), execute subprocesses (
python), and trigger other internal skills. - Sanitization: Absent. The skill is instructed to archive "full thread history (every message, untruncated)" and complete Slack conversations, potentially processing raw attacker-controlled text without filtering.
Audit Metadata