early-access-email-sequence
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npxfor installation as defined in its metadata (skill.meta.json). This is a standard practice for managing and executing node-based agent skills within its intended ecosystem. - [EXTERNAL_DOWNLOADS]: The skill fetches content from external websites via the
WebFetchtool to research company backgrounds. While this involves downloading remote data, it is a primary function of the skill and targets domains provided by the user. - [DATA_EXFILTRATION]: The skill extracts researched information (personal titles, company details, funding rounds) and writes generated email content to a Notion database using the
notion-create-pagestool. This behavior is transparently documented as the skill's intended output mechanism. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from the web (search results and website content) and interpolates it into prompts for email generation.
- Ingestion points: Data enters the context via
WebSearch(Phase 1) andWebFetch(Phase 2). - Boundary markers: The instructions do not specify any delimiters or safety markers (e.g., XML tags or 'ignore' warnings) to separate external data from agent instructions.
- Capability inventory: The agent has the capability to write to the filesystem (via Notion MCP) and perform further network operations (WebSearch).
- Sanitization: There is no explicit instruction to sanitize or validate the content retrieved from external URLs before processing it.
Audit Metadata