docusign-automation
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [SAFE]: The skill contains no executable code or scripts, consisting entirely of markdown instructions for tool usage.
- [EXTERNAL_DOWNLOADS]: References an external MCP server configuration at
https://rube.app/mcp. This is the primary infrastructure for the skill's functionality and is documented neutrally as a setup requirement. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that processes external data from DocuSign templates and envelopes, which constitutes a potential injection surface.
- Ingestion points: Data retrieved from
DOCUSIGN_LIST_ALL_TEMPLATES,DOCUSIGN_GET_TEMPLATE, andDOCUSIGN_GET_ENVELOPEis processed by the agent. - Boundary markers: No specific delimiters or instructions to ignore embedded commands in the document data are provided.
- Capability inventory: The skill utilizes tools to create and send envelopes (
DOCUSIGN_CREATE_ENVELOPE_FROM_TEMPLATE,DOCUSIGN_SEND_ENVELOPE) based on retrieved data. - Sanitization: No explicit sanitization or validation of the external DocuSign data is defined in the instructions.
Audit Metadata