onedrive
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from an external source (Microsoft OneDrive) which could potentially contain malicious instructions targeting the agent. \n
- Ingestion points: The skill utilizes Apideck's File Storage API to download and list files, bringing external content into the agent's context (SKILL.md). \n
- Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat external file content as untrusted data or to ignore embedded instructions. \n
- Capability inventory: The agent is granted capabilities to read, write, and manipulate files and folders via the Apideck SDK, which could be misused if influenced by injected content. \n
- Sanitization: The skill does not implement or describe any sanitization or validation mechanisms for the content retrieved from OneDrive. \n- [EXTERNAL_DOWNLOADS]: The skill references and fetches resources from the vendor's official infrastructure. \n
- Evidence: Downloads OpenAPI specifications from specs.apideck.com and references developer documentation from learn.microsoft.com.
Audit Metadata