skills/spotdraft/oncall-investigator-skills/contract-review-vs-approval-email-recipient-triage/Gen Agent Trust Hub
contract-review-vs-approval-email-recipient-triage
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a structured manual for developers or support staff to troubleshoot email recipient confusion. It does not automate any dangerous actions.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill mentions using tools like BigQuery, GCP Logging, and Django admin for investigation. These are standard internal observability practices. It does not include hardcoded credentials or methods for data exfiltration to unauthorized third parties.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to analyze user-provided data such as email subjects, bodies, and customer reports. While this creates a surface for indirect prompt injection, the skill is limited to read-only diagnostic tasks and lacks capabilities like file writing or command execution that could be abused via malicious input.
Audit Metadata