playbook-linkedin-engagement
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external LinkedIn posts (comments and reactions). This untrusted data is then optionally processed by an AI agent to generate personalization lines. A malicious actor could craft a LinkedIn comment containing instructions to manipulate the agent output.
- Ingestion points: LinkedIn engager records (including comments) are imported into a processing table in clay-table.md.
- Boundary markers: The instructions do not specify any delimiters or warnings to ignore instructions embedded within the LinkedIn comments.
- Capability inventory: The skill uses an AI-powered column in clay-table.md (Column 8) to generate personalized text.
- Sanitization: There is no evidence of filtering or sanitization applied to the raw comment text before it is passed to the AI line generator.
- [DYNAMIC_EXECUTION]: The skill provides code snippets (JavaScript and Python) and shell commands intended to be used with the clay CLI tool. While these are for building legitimate workflows, they represent dynamic logic provided by the skill author.
- Evidence: clay-table.md contains a JavaScript block for domain filtering. clay-workflow.md contains multiple Python functions for input validation and data shortlisting.
- Evidence: clay-workflow.md includes shell commands for listing actions, creating workflows, and running routines using the clay binary.
Audit Metadata