job-mkt
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from several untrusted or semi-trusted ingestion points, creating an injection surface.
- Ingestion points: The agent is instructed to read chat records from sales and customer service groups (Scenario 2), browse competitor websites and industry media (Scenario 4), and examine KOL social media homepages (Scenario 5).
- Boundary markers: The instructions include some negative constraints (e.g., "don't supplement missing data", "don't rewrite quotes", "don't force connections"), but there are no technical structural delimiters (like XML tags or specific block separators) to separate external data from system instructions.
- Capability inventory: The skill utilizes tools for browsing external URLs, reading/writing files (Documents, Spreadsheets, PPTs), and accessing internal chat histories.
- Sanitization: There is no evidence of automated sanitization, filtering, or escaping of the external content before it is processed or incorporated into output documents.
- [DATA_EXFILTRATION]: The skill is designed to access sensitive internal communication channels (Scenario 2: Sales and Customer Service chat logs). While the provided instructions focus on legitimate extraction for marketing purposes, this represents a high-privilege access pattern. If an attacker successfully performs an indirect prompt injection via the browser tool (Scenario 4 or 5), they could potentially instruct the agent to exfiltrate the sensitive chat data to an external URL.
Audit Metadata