mfa-flow-test-author
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines workflows that ingest data from external sources and use it to drive automated actions, creating a surface for indirect prompt injection.
- Ingestion points: Data is retrieved from API response bodies (
r.json()) during MFA enrollment inSKILL.mdand from external delivery stubs (sms_stub.last_otp()) in Step 3. The skill also reads from virtual authenticator outputs inreferences/webauthn-virtual-authenticator.md. - Boundary markers: The instructions do not demonstrate the use of delimiters or "ignore embedded instructions" warnings when processing these external values, leaving the agent susceptible to instruction injection if the external source is compromised.
- Capability inventory: The skill utilizes capabilities for network requests (
client.post), browser automation via Playwright (page.click,page.goto), and database interactions (db.set_totp_secret), providing multiple vectors for an injection to cause unintended actions. - Sanitization: Example code snippets do not include explicit logic for sanitizing or validating external inputs before they are passed into subsequent logic steps.
Audit Metadata