persona-insights-analysis
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted transcript data from multiple sources, which presents an attack surface for instructions hidden within the text aimed at influencing the agent's behavior.
- Ingestion points: Transcripts provided via pasted text, CSV exports, DOCX, or PDF files, as well as external call-recording connectors.
- Boundary markers: The instructions lack explicit delimiters or "ignore previous instructions" warnings to separate the data being analyzed from the skill's primary logic.
- Capability inventory: The skill reads file content, fetches external URLs, and integrates with other tools like Notion for output generation.
- Sanitization: There is no evidence of text sanitization or filtering to prevent the agent from executing commands embedded in the transcripts.
- [EXTERNAL_DOWNLOADS]: The skill contains logic to automatically retrieve data from external web locations specified in user-provided files.
- Evidence: Under Step 1, the skill states: "A CSV column holding a link to a transcript gets fetched if the link is reachable."
- Risk: This capability allows the skill to fetch and process content from arbitrary URLs, which could lead to the ingestion of malicious content or the potential scanning of internal network resources if not restricted by the execution environment.
Audit Metadata