outbound-sales
Fail
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md specifically direct the agent to download and execute a script from 'https://api.gtm-tools.sh/extension/install.sh' by piping it directly into the bash shell. This pattern allows for unverified remote code execution.
- [EXTERNAL_DOWNLOADS]: The skill relies on external resources and scripts hosted on the 'gtm-tools.sh' domain to function and install extensions.
- [COMMAND_EXECUTION]: The skill uses shell-based commands (curl) to interact with an external API for all its primary operations, including account detection and data retrieval.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to how it handles external data. 1. Ingestion points: Untrusted content is ingested from LinkedIn posts via 'list_user_posts' and Trustpilot review themes via 'detect_signal' in SKILL.md. 2. Boundary markers: No delimiters or instructions are used to separate this untrusted data from the agent's instructions. 3. Capability inventory: The agent uses this data to draft outbound messages and DMs. 4. Sanitization: There is no evidence of sanitization or validation performed on the external content before it is interpolated into message templates.
Recommendations
- HIGH: Downloads and executes remote code from: https://api.gtm-tools.sh/extension/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata