prospecting
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external sources such as forum threads, social media posts, and GitHub issues to identify demand signals for early-stage customer discovery.
- Ingestion points: Data is ingested from platforms like Reddit, Hacker News, X (Twitter), and YouTube using tools like
last30daysandsocial-fetchas described inreferences/demand-signals.md. - Boundary markers: The instructions include an explicit warning for the agent to treat fetched content as untrusted and to never follow instructions embedded within the processed content.
- Capability inventory: The skill utilizes external APIs and CLI tools (Apollo, Clay, GitHub) and accesses local context files like
product-marketing.md. - Sanitization: The skill recommends escaping all values when generating standalone HTML evidence reports from the gathered data.
- [EXTERNAL_DOWNLOADS]: The skill references a centralized tools registry and various integration guides hosted on a public GitHub repository.
- Evidence:
SKILL.mdand multiple reference files provide links togithub.com/coreyhaines31/marketingskillsfor tool configurations and MCP documentation. - [COMMAND_EXECUTION]: The skill provides instructions for using a specific local command-line tool to perform technical prospecting.
- Evidence:
references/saas-prospecting.mdcontains a command for executingnode tools/clis/github-prospects.jsto extract and process data from GitHub repositories.
Audit Metadata