job-ops
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface for indirect prompt injection as it is designed to ingest and process untrusted data from external chat logs in Scenarios 2 (User Feedback Classification) and 4 (Activity Review).
- Ingestion points: The agent is instructed to fetch and process chat records from specified groups in
SKILL.md(e.g., "获取...群名清单里的聊天记录"). - Boundary markers: The skill does not currently define explicit markers or delimiters to isolate untrusted chat content from its own instructions, nor does it explicitly warn the agent to ignore commands found within those logs.
- Capability inventory: The agent has capabilities including browser automation, writing data to multidimensional tables (Feishu/Lark), and creating organizational tasks.
- Sanitization: There is no evidence of content sanitization or filtering of the processed logs within the provided instructions.
- [SAFE]: The skill demonstrates security-conscious behavior by instructing the agent to alert the user if platform login states expire or if data cannot be retrieved, rather than attempting to bypass authentication or using placeholder data (Scenario 1).
Audit Metadata