reply-audit
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted data from external leads.
- Ingestion points: SKILL.md Step 0 defines multiple ways to ingest data, including Google Drive links, Notion pages, and outreach platform MCPs (Model Context Protocol).
- Boundary markers: While the instructions suggest using quoted blocks for replies in the final output, there are no explicit boundary markers or 'ignore' instructions provided to the agent for the ingestion and processing phase of the untrusted data.
- Capability inventory: The skill demonstrates extensive capabilities, including reading from Google Drive and Notion, and writing to external pages via 'notion-create-pages' (SKILL.md, Step 4).
- Sanitization: There is no mention of sanitizing, escaping, or validating the external content before it is interpolated into the agent's context or used to generate the final audit report.
Audit Metadata