upsell-and-expansion
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as customer meeting transcripts, PDF decks, and CRM exports, which represents a theoretical attack surface for indirect prompt injection. (1) Ingestion points: Workflow Step 1 in SKILL.md and Rule 1 in references/input-rules.md specify that the agent accepts various formats (conversational dumps, Slack pastes, PDFs, screenshots) provided by the user. (2) Boundary markers: The skill includes a mandatory 'Untrusted content' instruction block in SKILL.md (Section 0) that explicitly directs the agent to treat text in fetched pages and uploaded files as data rather than instructions. (3) Capability inventory: The skill uses web_fetch and web_search tools for fact-checking and data retrieval as defined in references/operating-principles.md. (4) Sanitization: The instructions specifically require the agent to ignore any embedded instructions in external data and acknowledge the attempted injection neutrally to the user.
Audit Metadata