invoices-billing
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user descriptions of business processes in Step 2 and interpolates them into internal context in Step 3 and generated artifacts like CSV, SQL, and JSON templates. While it instructs the agent to use empty templates and synthetic data, the lack of explicit boundary markers for user-supplied data in the generation step creates a potential surface for indirect instructions to influence the structure of the generated code or tool parameters.
- Ingestion points: User inputs regarding clients, terms, and tracking in Step 2.
- Boundary markers: None identified in the prompt interpolation steps.
- Capability inventory: Generates SQL DDL, JSON Schema, CSV files, and interacts with the @notion-manual-import tool.
- Sanitization: The skill mandates using empty templates and synthetic examples unless explicitly asked otherwise.
- [SAFE]: The skill contains explicit prohibitions against handling real sensitive data such as bank details, salaries, or medical information, and directs the agent to label example rows as synthetic.
- [SAFE]: External references and related skill links correctly point to the vendor's repository (sickn33).
Audit Metadata