day-planner
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves data from external entities such as tasks, pull requests, and incidents via Port API queries in SKILL.md, creating a surface where malicious instructions embedded in that data could potentially influence the agent's behavior. The risk is assessed as safe because the skill is limited to information display and lacks dangerous capabilities.
- Ingestion points: External data is retrieved from Port blueprints including task, service, pull_request, incident, and deployment as defined in SKILL.md.
- Boundary markers: No explicit delimiters or instructions for the agent to ignore embedded commands are present in the planning process instructions.
- Capability inventory: The skill is limited to data retrieval and visual formatting in SKILL.md, with no dangerous capabilities such as file system modification, privilege escalation, or arbitrary network communication.
- Sanitization: There is no logic specified to sanitize or filter the content retrieved from the Port platform entities.
- [SAFE]: The skill provides standard administrative functionality for the Port developer portal, authored by a vendor representative, and contains no suspicious code or instructions.
Audit Metadata