knowledge-capture
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from conversation transcripts and unstructured meeting notes. This creates a surface for indirect prompt injection, where an attacker could embed malicious instructions in the transcript to influence the agent's actions during the Notion documentation process.\n
- Ingestion points: Conversation text, transcripts, and discussion notes processed by the agent (referenced in SKILL.md and evaluations/scenario-1-meeting-notes.json).\n
- Boundary markers: The instructions do not define clear delimiters or "ignore embedded instruction" warnings to protect the agent from following commands contained within the source text.\n
- Capability inventory: The skill requires the agent to use the Notion API (network operations) to create and update documentation pages.\n
- Sanitization: No explicit sanitization, validation, or instruction-filtering for the input content is described in the implementation details.\n- [NO_CODE]: The skill consists solely of markdown documentation, best practices guides, and evaluation scenarios. It does not include any executable scripts (Python, JavaScript, Shell), binaries, or package manifest files.
Audit Metadata