Skills
skills/growthenginenowoslawski/coldoutboundskills/email-deliverability-audit/Gen Agent Trust Hub

email-deliverability-audit

Fail

Audited by Gen Agent Trust Hub on Apr 30, 2026

Risk Level: HIGHCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Vulnerability in scripts/check-domain-auth.ts where the dig function interpolates variables directly into a shell command using execSync. An attacker can inject arbitrary shell commands via the --domains or --dkim-selector CLI arguments, or by providing malicious domain data in the input CSV (which may originate from the Smartlead API).\n- [DATA_EXFILTRATION]: The command injection vulnerability in scripts/check-domain-auth.ts can be exploited to exfiltrate sensitive local data (such as environment variables, SSH keys, or AWS credentials) to an external server using standard network tools like curl or wget.\n- [PROMPT_INJECTION]: Vulnerable to Indirect Prompt Injection (Category 8).\n
  • Ingestion points: scripts/audit-inboxes.ts and scripts/audit-performance.ts ingest untrusted data (inbox metadata, tags, and campaign names) from the Smartlead API.\n
  • Boundary markers: Absent. There are no delimiters or instructions to ignore embedded commands when processing or reporting this data.\n
  • Capability inventory: The skill possesses powerful capabilities, including shell command execution via execSync in the DNS audit script.\n
  • Sanitization: No validation or escaping is performed on external data before it is used in terminal operations or synthesized into reports.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Apr 30, 2026, 10:21 AM
Security Audit — agent-trust-hub — email-deliverability-audit