get-top-conference-attendees

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONPERSISTENCEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/build_conference_writer.py generates Python code as strings (intake_code) which are then injected into Clay workflow nodes via the CLI. Additionally, scripts/test_offline.py utilizes exec() and compile() to verify this generated code locally before deployment.
  • [COMMAND_EXECUTION]: The skill frequently uses subprocess.run to execute clay CLI commands for workspace management, workflow creation, and record upserts. It also provides curl commands in its documentation for managing authentication flows.
  • [PERSISTENCE]: The skill maintains state and credentials across sessions by writing to files in the user's home directory (~/.lanyard-env and ~/.clay-conference-writer/). The credential file is secured with 0o600 permissions.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with the Lanyard API (lanyard.redlinegrowth.com) to retrieve and enrich attendee data, as well as to manage user accounts and campaign statuses.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface through scripts/attendee_list.py (which parses CSV/TSV files) and API responses from Lanyard. While the skill includes data validation logic in scripts/audience_lib.py to prevent malformed data from being written, the processed data is returned to the agent context.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 06:11 AM