call-followup-sweep
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (transcripts and user notes) which creates a surface for indirect prompt injection if a participant in a call purposefully includes malicious instructions.
- Ingestion points: External transcript data, recordings, and user notes are pulled into the agent context in
SKILL.md(Step 2 of 'The Sweep'). - Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" directives to differentiate between the agent's instructions and the content of the transcript data.
- Capability inventory: The skill is limited to reading data and generating email drafts; it explicitly prohibits sending messages, scheduling, or writing to external systems like CRMs (
SKILL.md, Rules section). - Sanitization: No validation, filtering, or escaping is performed on the extracted transcript content before it is processed by the agent to generate drafts.
Audit Metadata