go-to-market
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The
scripts/pacing-alert.pyscript performs network requests to external APIs defined in environment variables (Pipeline, Recruiting, and Email) to fetch campaign pacing information. - [PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data sources including sales-call transcripts and CRM deal data, as described in
references/revenue-intelligence.md, creating a surface for indirect prompt injection. Findings regarding this attack surface include: Ingestion points: Untrusted data enters via the analysis of transcripts, CRM records, and SEO tool data; Boundary markers: The instructions do not specify any delimiters or warnings to ignore embedded instructions in the processed data; Capability inventory: The local scripts (experiment-engine.py,pacing-alert.py, etc.) are limited to statistical processing and network reporting, with no arbitrary command execution or dangerous file system access; Sanitization: No explicit sanitization or filtering of external content is mentioned in the skill instructions.
Audit Metadata