kai-sdr-operator
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to execute local Python scripts included in the platform harness, such as banned_word_check.py and sdr_loop_eval.py, to perform quality assurance and workflow validation.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources including Apify web extraction and RapidAPI, which creates a surface for potential injection of malicious instructions via untrusted content.
- Ingestion points: External data enters the agent context via connectors for web scraping and third-party enrichment defined in Phase 3 of the SKILL.md and connector-recipes.md.
- Boundary markers: The skill includes a specific evaluation scenario for 'prompt-injected-scraped-page' in references/evaluation-harness.md and uses a staged worker model to isolate untrusted data processing.
- Capability inventory: The agent has the capability to generate outreach messages and prepare record mutation payloads for CRMs like HubSpot and Salesforce and email sequencers like Instantly.
- Sanitization: Strict human-in-the-loop approval gates are required for all live outbound actions, and dry-run diffs must be produced and reviewed before any external system state is modified.
Audit Metadata