cold-email
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, which creates a vulnerability surface for indirect prompt injection.
- Ingestion points: The skill instructions direct the agent to read product marketing context from local files (e.g.,
.agents/product-marketing.md) and to incorporate external 'research signals' such as LinkedIn posts, company news, and prospect replies into generated email content and triage workflows. - Boundary markers: The instructions lack specific boundary markers or 'ignore embedded instructions' directives to prevent the agent from executing malicious commands that might be hidden within the external research data or prospect replies.
- Capability inventory: The skill leverages several high-capability external tool integrations (Instantly, lemlist, HeyReach, HubSpot, etc.) for sending emails, managing LinkedIn outreach, and logging CRM activity. Malicious instructions in prospect data could potentially influence how these tools are used.
- Sanitization: There are no mentioned mechanisms for sanitizing, escaping, or validating the external content before it is interpolated into the agent's prompt context.
Audit Metadata