get-qualified-leads-from-luma
Warn
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute local Python scripts using shell commands (e.g.,
python3 skills/luma-event-attendees/scripts/scrape_event.py) which allows for arbitrary command execution if parameters are not properly sanitized. - [DATA_EXFILTRATION]: The skill sends data (lead information) to external URLs provided by the user (Slack Webhooks) using
urllib.request. While this is the intended purpose, it represents a data exfiltration surface if a malicious user provides an attacker-controlled URL. - [EXTERNAL_DOWNLOADS]: The skill relies on external services like Apify for scraping and Google Sheets for data storage, which involves network interactions with these third-party platforms.
- [CREDENTIALS_UNSAFE]: The documentation suggests managing sensitive tokens like
APIFY_API_TOKENvia environment variables or.envfiles, which is a standard practice but highlights the handling of sensitive credentials.
Audit Metadata