cancel-reason-classifier
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-generated free-text reasons, which introduces a potential surface for indirect prompt injection if the agent follows the suggested LLM fallback workflow.
- Ingestion points: Free-text data enters the system through the
cancel_reason_rawfield in external cohort JSON files. - Boundary markers: The workflow description does not specify the use of delimiters or 'ignore' instructions when passing residues to the LLM for classification.
- Capability inventory: The skill performs file system operations (read/write) and executes a local Python script for keyword matching.
- Sanitization: No sanitization or filtering is applied to the raw input text beyond basic lowercasing.
- [SAFE]: The classification logic is primarily deterministic and utilizes
yaml.safe_load()for configuration parsing, effectively mitigating risks associated with untrusted YAML data.
Audit Metadata