local-signal-pipeline
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: This skill consists entirely of architectural documentation and design principles. No executable scripts, binaries, or platform tools are included.
- [DATA_EXPOSURE]: The architecture plans to scrape personal and life-event data from public registries (Real-estate, Business formation, Divorce dockets, Birth registries). This represents a significant privacy risk surface, although it is presented as a design for a lead generation system.
- [INDIRECT_PROMPT_INJECTION]: The design incorporates automated ingestion of untrusted external data (scrapes from Yad2, MLS, etc.). This introduces a vulnerability surface where malicious content in the source data could influence automated downstream agent actions (like outreach generation).
- Ingestion points: Signal source plugins (e.g., nadlan, us-county-recorder) described in SKILL.md.
- Boundary markers: None defined in the architecture documentation.
- Capability inventory: WhatsApp voice notes (WAHA), Facebook group posts, Meta/Google ad geofencing.
- Sanitization: No sanitization or validation logic is defined in the provided document.
Audit Metadata