skills/growthenginenowoslawski/coldoutboundskills/personalization-subagent-pattern/Gen Agent Trust Hub
personalization-subagent-pattern
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted lead data, specifically the company_description field, into sub-agent prompts without explicit sanitization or strict boundary delimiters.
- Ingestion points: The sub-agent prompt template in references/prompt-template.md and SKILL.md directly interpolates a JSON_ARRAY_OF_LEADS into the context.
- Boundary markers: Uses markdown headers like ## Leads but lacks specific instructions to ignore embedded commands within the lead data.
- Capability inventory: Uses the Task tool (general-purpose sub-agent) and performs file read/write operations in /tmp and the user's home directory.
- Sanitization: No input sanitization is performed on the lead data before interpolation.
- [DYNAMIC_EXECUTION]: The pattern relies on dynamically generating and launching multiple Task sub-agents based on lead batches.
- Evidence: The orchestrator pseudocode in SKILL.md describes chunking leads and launching parallel Task calls with dynamically constructed prompts.
Audit Metadata