coral
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from a wide variety of external sources (GitHub, Jira, Slack, Linear, Datadog, Sentry). This data is untrusted and could contain malicious instructions.
- Ingestion points: Untrusted data enters the agent context through the
sqlanddescribetools which fetch content from external platforms as described inSKILL.md. - Boundary markers: The instructions do not mandate the use of delimiters or specific framing to separate external data from the agent's internal reasoning or to warn the agent to ignore instructions embedded in that data.
- Capability inventory: The skill workflow explicitly allows the agent to use retrieved data to guide code modifications ("If editing code, use the Coral result to guide changes"), potentially allowing an attacker to influence the local codebase.
- Sanitization: There are no explicit instructions for the agent to sanitize, filter, or validate the content retrieved from external sources before acting upon it.
Audit Metadata