skills/spotdraft/oncall-investigator-skills/email-sender-variable-business-user-fallback/Gen Agent Trust Hub
email-sender-variable-business-user-fallback
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The diagnostic workflow described in the skill ingests data from external logs and templates, which presents a surface for indirect prompt injection.
- Ingestion points: The skill retrieves data from administrative API endpoints (
api.spotdraft.com) and database tables (public_contracts_v3_contractsignaturesetup) that store email audit logs and template definitions. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to isolate or ignore instructions that may be embedded within the retrieved data.
- Capability inventory: The skill directs the agent to perform diagnostic web requests to administrative panels and execute SQL queries against production and QA datasets.
- Sanitization: No sanitization or validation steps for the retrieved content are mentioned in the troubleshooting steps.
- [NO_CODE]: This skill consists entirely of instructional markdown text and does not contain any executable scripts, binaries, or other code components.
Audit Metadata