segment-audience
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local Python script to manage execution approvals, using shell interpolation for variables.
- Evidence: The 'Execution gate' section utilizes the command
python "${CLAUDE_PLUGIN_ROOT}/scripts/approval-manager.py" --brand {slug} .... - The use of shell commands with variable interpolation (like
{slug}) poses a potential risk if the source of these variables is not strictly controlled or sanitized, potentially allowing for command injection. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources such as CRMs and web analytics platforms.
- Ingestion points: The process in SKILL.md (Steps 2 and 3) involves querying 'connected platforms' for contact fields, custom properties, and behavioral data.
- Capability inventory: The skill possesses write capabilities, allowing it to create and update segments on external platforms (Salesforce, HubSpot, Meta, etc.) via platform MCPs.
- Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from interpreting instructions that might be embedded within external data fields (e.g., a customer name or company field containing prompt injection).
- Sanitization: The skill performs schema validation but does not specify content sanitization for the data retrieved from external sources.
Audit Metadata