unified-notifications-ops
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest, classify, and route notifications from external platforms such as GitHub, Linear, and email. This design pattern creates a surface for indirect prompt injection, where an attacker could embed malicious instructions in a GitHub comment or issue title that the agent might then interpret as a command while processing the notification.
- Ingestion points: External event sources including GitHub (PRs, reviews, comments), Linear (issue movement), and connected communication surfaces (email/chat).
- Boundary markers: The skill does not define clear delimiters or instruct the agent to ignore potentially malicious instructions embedded within the notification content.
- Capability inventory: The skill is intended to orchestrate actions using other tools, including triggering hooks, using other skills for triage, and delegating classification to other agents.
- Sanitization: No explicit logic or instructions are provided to sanitize, escape, or validate the content of the notifications before the agent summarizes or routes them.
- [SAFE]: The skill includes explicit security constraints, specifically mandating that the agent must never expose tokens, secrets, webhook secrets, or internal identifiers. It is an instructional guide for workflow organization rather than a script containing executable logic.
Audit Metadata