inbox-lifecycle-manager
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with the Smartlead API at
server.smartlead.aito fetch account details and domain metrics. This is the intended purpose of the skill and uses legitimate API endpoints. - [COMMAND_EXECUTION]: The documentation provides instructions for running local TypeScript scripts using
npx tsx. These scripts perform calculations, generate CSV reports, and update tags via the Smartlead API. All operations are transparent and intended for local execution by the user. - [CREDENTIALS_SAFE]: Secret management follows best practices by using an environment variable (
SMARTLEAD_API_KEY). The scripts include logic to mask this key in error logs, preventing accidental exposure. - [DATA_EXPOSURE]: The skill reads account metadata and performance metrics. It does not access sensitive local files such as SSH keys, cloud credentials, or environment configuration files beyond the required API key.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external API (tags, email addresses, and metrics). This data is processed by TypeScript logic rather than being directly interpolated into agent prompts, which significantly reduces the surface for injection attacks.
Audit Metadata