account-handover
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted data from Vitally notes and conversations to synthesize handover documents.
- Ingestion points: Data is pulled via
vitally:get_account_notesandvitally:get_account_conversationsinSKILL.md(Step 1d). - Boundary markers: The instructions do not specify any delimiters or warnings to the agent to ignore instructions that might be embedded within the customer notes.
- Capability inventory: The agent has access to
query-runfor SQL execution and multiple Vitally API tools. - Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from external records before it is interpolated into the synthesis workflow.
- [DYNAMIC_EXECUTION]: The skill dynamically generates SQL queries for the
query-runtool by interpolating variables (e.g.,{externalId}) retrieved from Vitally API calls. While this is consistent with the skill's primary purpose, it creates a surface for injection if the source data in the CRM is compromised.
Audit Metadata