identity-graph-operator
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an identity resolution engine that ingests records from any source to match them against a shared identity graph. This processing of untrusted external data creates a potential surface for indirect prompt injection attacks.
- Ingestion points: External records representing entities (people, companies, etc.) are ingested from "any source" into the agent's context.
- Boundary markers: There are no explicit instructions or delimiters defined to separate untrusted data from the agent's core identity resolution logic.
- Capability inventory: The skill possesses capabilities to resolve identities, propose merges/splits, and mutate a shared graph state based on the provided evidence.
- Sanitization: While the skill includes normalization routines for emails, phone numbers (using regex), and names (nickname expansion), it lacks specific sanitization measures to filter out or ignore instructions embedded within the data fields.
Audit Metadata