onboarding-user
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites (via the
analyzing-brandsub-skill) and direct user input, writing this information into persistent configuration files (./supercmo-company/brand.mdandcompetitors.md). Because these files are explicitly designed to be read by every later agent session, malicious instructions embedded in a website or user response could potentially influence the agent's behavior in the future. - Ingestion points: External website content processed in Step 2 and user-provided brand details or corrections in Steps 1 and 4.
- Boundary markers: The instructions do not define delimiters or markers to separate the ingested untrusted content from the agent's internal logic within the saved files.
- Capability inventory: The skill performs file writing and patching operations and invokes multiple sub-skills (
analyzing-brandandidentifying-competitors). - Sanitization: No sanitization, validation, or filtering mechanisms are described for the content before it is stored in the company profile.
Audit Metadata