skills/security-phoenix-demo/security-skills-claude-code/phoenix-context-curator/Gen Agent Trust Hub
phoenix-context-curator
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted raw input from various external sources including Slack threads, support tickets, and call transcripts. This ingestion surface is vulnerable to indirect prompt injection where malicious instructions embedded in the input could influence the agent's behavior.
- Ingestion points: The skill accepts raw context from external sources (notes, tickets, Slack threads, transcripts) as described in the frontmatter and task description.
- Boundary markers: The instructions do not define clear delimiters or "ignore embedded instructions" headers for the processed data, increasing the risk of the agent obeying instructions hidden within the input.
- Capability inventory: The skill involves writing the structured output to a file system path (
outputs/{session-id}/01-clean-context.md). - Sanitization: There is no evidence of sanitization, escaping, or validation logic applied to the external content before it is processed or written to the output file.
Audit Metadata