content-voice-and-proof
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has a high surface area for indirect prompt injection by processing untrusted data from multiple external sources.
- Ingestion points: Instructions in
SKILL.md(Sections 2 and 3) direct the agent to read 30-50 customer reviews, lead form messages, call notes, and private owner emails to customers. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' prompts when processing this external text.
- Capability inventory: The data extracted (voice habits, customer phrases, proof bank) is used by downstream skills like
content-blog-postandlaunch-agent-guardrailsto generate autonomous content and customer replies. - Sanitization: While the skill instructs the agent to 'strip names and contact details,' there is no requirement to sanitize the text for embedded instructions or malicious patterns that could subvert the agent's behavior.
- [DATA_EXFILTRATION]: The skill involves the systematic collection and processing of sensitive business and customer information.
- The skill instructs the agent to access and analyze private owner communications (emails, texts) and lead form data which may contain sensitive PII or business logic.
- While the skill includes 'Proof Bank' rules for consent and PII removal, the initial ingestion of these files by the AI agent represents a data exposure risk if the agent environment is not properly scoped.
Audit Metadata