cold-email-outreach
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites and social media profiles to personalize outbound emails, creating a surface for indirect prompt injection attacks.
- Ingestion points: Content is fetched from arbitrary external URLs using tools such as
firecrawl_urls_scrape,firecrawl_urls_scrape_batch, andscrape_linkedin_profiles(as described in Phase 3 ofSKILL.md). - Boundary markers: The skill instructions do not prescribe specific delimiters or instructions to ignore embedded commands within the scraped content during the personalization phase.
- Capability inventory: The agent has the capability to send emails directly via
gmail_messages_sendandgmail_reply_to_messageafter processing the data. - Sanitization: No programmatic sanitization or validation of external content is described. The skill relies on a procedural 'drafts-first' policy for manual user review of the first three messages to detect malicious output.
Audit Metadata