weekly-expansion-scan
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external billing and CRM systems and outputs the results to a digest channel, creating a potential surface for indirect prompt injection if external fields (e.g., company names, notes) contain malicious instructions.
- Ingestion points: Active subscription data from
{{BILLING_SOURCE}}, account records from{{CRM}}(Step 1), and target account details from{{EXPANSION_TARGETS_FILE}}(Step 3). - Boundary markers: Absent. There are no instructions or delimiters provided to the agent to treat external data as untrusted.
- Capability inventory: The skill generates and posts ranked digests and individual account messages containing external data to the
{{DIGEST_CHANNEL}}(Step 5). - Sanitization: Absent. The instructions do not mandate sanitization or validation of the ingested data before it is interpolated into messages.
- [DYNAMIC_EXECUTION]: The skill explicitly directs the agent to generate and run code to perform account scoring, which is a common but relevant execution pattern.
- Evidence: "Compute the score in code, not by eye" (Step 2). This instruction results in the agent creating a temporary script to process calculations based on the defined scoring logic.
Audit Metadata