messages-ops
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of processing untrusted external data.
- Ingestion points: The skill explicitly reads and processes content from 'local messages', 'X / social DM', and 'browser-gated message surfaces' as part of its retrieval workflow in
SKILL.md. - Boundary markers: No explicit instructions are provided to use delimiters or ignore instructions embedded within the retrieved messages, increasing the risk that an attacker-controlled message could hijack the agent's behavior.
- Capability inventory: The skill is designed to retrieve, inspect, and summarize message threads, and can potentially hand off data to other skills like
knowledge-opsorlead-intelligence. - Sanitization: There are no instructions for sanitizing, escaping, or validating the content of the messages or one-time codes before they are output or passed to other tools.
Audit Metadata