lead-intelligence
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from external sources and uses it to drive agent behavior.
- Ingestion points: Public profile data, recent posts, and company news are fetched from the X API, LinkedIn (via browser/cookies), GitHub, and Exa web search (
enrichment-agent.md,signal-scorer.md). - Boundary markers: The agent instructions for the
outreach-drafterandenrichment-agentlack explicit delimiters or instructions to ignore potential commands embedded in the fetched profile content. - Capability inventory: The skill possesses the ability to create email drafts in the local Apple Mail application and prepare messages on LinkedIn and X via browser control or API (
SKILL.md). Agents also have access to theBashtool for local operations. - Sanitization: There is no evidence of sanitization or escaping of the external content before it is interpolated into the generation prompts for outreach messages.
Audit Metadata