clay-cost-tuning

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill includes code designed to process external lead data, which creates a surface for indirect prompt injection.
  • Ingestion points: The rows array parameter in src/clay/cost-filter.ts and src/clay/sampler.ts accepts untrusted data input.
  • Boundary markers: No delimiters or specific instructions to ignore embedded prompts are provided in the scripts.
  • Capability inventory: The skill utilizes Read, Write, Edit, and Grep tools; the provided scripts do not perform network operations or subprocess execution.
  • Sanitization: The scripts implement business logic filtering (e.g., domain checks) but do not perform security-focused sanitization of the input strings.
  • [EXTERNAL_DOWNLOADS]: The skill references official documentation and pricing pages from Clay for user reference. These references target a well-known service and do not involve the download or execution of remote code.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:42 AM