cowork-productivity-assistant
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill has a large attack surface for indirect prompt injection because its core functionality involves processing untrusted data from local folders, document batches, and web scraping operations.
- Ingestion points: Untrusted data enters the agent context through the
FileOrganizationEngine(scanning user folders),DocumentProcessingPipeline(extracting text from PDF, Word, and Excel files), andWebAutomationEngine(scraping content from user-provided URLs). - Boundary markers: The skill documentation describes a safety framework, but the provided instructions and prompt lack explicit technical delimiters or specific instructions to the agent to ignore embedded commands within the processed data.
- Capability inventory: The skill possesses significant capabilities that could be abused if an injection occurs, including file system modification (moving/deleting files via
FileOrganizationEngine), network access (scraping and form submission viaWebAutomationEngine), and execution of system commands (as referenced in thePermissionManagerpseudo-code). - Sanitization: There is no evidence of sanitization or filtering of the content extracted from documents or web pages before it is processed by the AI planning engine.
Audit Metadata