onboarding-kickoff
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes lead data from Google Sheets and client-provided descriptions by interpolating them into LLM prompts in casualize_company_names_batch.py and instantly_create_campaigns.py without sanitization. \n
- Ingestion points: External spreadsheet data via worksheet.get_all_values(). \n
- Boundary markers: None; data is directly concatenated into prompts. \n
- Capability inventory: The agent can write to files/sheets, send emails via Gmail API, and interact with the Instantly campaign API. \n
- Sanitization: None provided, allowing malicious input in spreadsheet fields to potentially override agent instructions.\n- [COMMAND_EXECUTION]: The orchestration script onboarding_post_kickoff.py uses subprocess.run to execute other Python scripts. While it uses a list-based argument format, it passes user-provided payload data directly as command-line arguments, creating a potential attack surface if sub-scripts process these arguments unsafely.\n- [REMOTE_CODE_EXECUTION]: The skill references multiple missing local dependencies. Orchestration logic in onboarding_post_kickoff.py attempts to run scripts from a non-existent execution/ directory, and gmaps_lead_pipeline.py attempts to import local modules (scrape_google_maps, scrape_website_contacts) that are not included in the package. These missing components represent unverifiable and broken execution paths.\n- [METADATA_POISONING]: The instantly_create_campaigns.py script references non-existent AI models (e.g., claude-opus-4-5-20251101). These hallucinated identifiers suggest the code is poorly verified or deceptive, and will lead to errors when the skill attempts to call the Anthropic API.
Audit Metadata