docusign-automation

Pass

Audited by Gen Agent Trust Hub on Nov 3, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
  • [SAFE]: The skill contains no executable code or scripts, consisting entirely of markdown instructions for tool usage.
  • [EXTERNAL_DOWNLOADS]: References an external MCP server configuration at https://rube.app/mcp. This is the primary infrastructure for the skill's functionality and is documented neutrally as a setup requirement.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that processes external data from DocuSign templates and envelopes, which constitutes a potential injection surface.
  • Ingestion points: Data retrieved from DOCUSIGN_LIST_ALL_TEMPLATES, DOCUSIGN_GET_TEMPLATE, and DOCUSIGN_GET_ENVELOPE is processed by the agent.
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands in the document data are provided.
  • Capability inventory: The skill utilizes tools to create and send envelopes (DOCUSIGN_CREATE_ENVELOPE_FROM_TEMPLATE, DOCUSIGN_SEND_ENVELOPE) based on retrieved data.
  • Sanitization: No explicit sanitization or validation of the external DocuSign data is defined in the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 3, 2026, 03:14 AM