clay-mastery
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references multiple external API endpoints for data enrichment services, such as Prospeo, Findymail, and FullEnrich, intended to be accessed via the ColdIQ marketplace infrastructure.
- [COMMAND_EXECUTION]: The skill provides JavaScript snippets (Clayscript) for data cleaning, domain extraction, and conditional logic. These operations are restricted to standard string and regex manipulations for use within the Clay platform.
- [PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by defining templates for AI-based company qualification and personalization that incorporate external data fields.
- Ingestion points: Data ingested during the 'Input' phase, including Company Name, Domain, and LinkedIn URL as described in 'SKILL.md'.
- Boundary markers: Absent; variables like '{{Signal}}' are interpolated directly into natural language prompts without delimiters.
- Capability inventory: Capabilities are limited to data enrichment API calls and text generation; no local file system access or shell command execution is provided.
- Sanitization: No sanitization or validation processes are mentioned for data before it is interpolated into prompts.
Audit Metadata