job-design
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to aggregate and process untrusted data from external sources, which constitutes an attack surface for indirect prompt injection.
- Ingestion points: The skill instructions explicitly direct the agent to read and process content from "Cloud Document PRDs", "Document comments", and "Review groups/chats" (SKILL.md).
- Boundary markers: While the skill uses specific instruction templates and negation clauses (e.g., "Do not supplement logic the product manager did not write") to constrain the agent's behavior, it does not employ robust security delimiters or instructions to ignore potential malicious commands embedded within the ingested data.
- Capability inventory: The skill requires capabilities to read external documents, access chat/comment history, and use a browser to research visual trends (SKILL.md).
- Sanitization: There is no evidence of input sanitization, filtering, or validation to ensure that instructions embedded in chat logs or PRDs do not influence the agent's core logic.
Audit Metadata