sales-spark-mail
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it maintains a persistent knowledge state in
references/learnings.md. The skill reads this file at the start of every session and appends new information to it based on user interactions, creating a feedback loop for potentially malicious instructions. - Ingestion points: The agent reads
references/learnings.mdduring Step 1 to gather context and accepts free-text input from the user describing their needs. - Boundary markers: The skill does not implement delimiters or specific instructions to ignore embedded commands when processing the contents of
references/learnings.md. - Capability inventory: The skill instructions specifically direct the agent to append discovered gotchas, workarounds, or tips to the
references/learnings.mdfile, providing a mechanism for persisting data across sessions. - Sanitization: There is no evidence of sanitization, validation, or escaping of the content before it is persisted to the local filesystem.
Audit Metadata