lindy-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the user to build an agent that ingests and summarizes webhook payloads (
{{webhook_received.request.body}}) and then performs actions like posting to Slack or Gmail. This architecture creates a surface for indirect prompt injection, where a malicious payload could contain instructions designed to manipulate the agent's behavior or exfiltrate data. - [COMMAND_EXECUTION]: The skill uses a
curlcommand in the testing phase to simulate a webhook event. The command is used legitimately for testing and utilizes placeholders for sensitive credentials. - [EXTERNAL_DOWNLOADS]: The implementation guide references the
@lindy-ai/sdkNode.js package and thelindyPython package. These are official/standard libraries for the Lindy platform and are required for the skill's functionality.
Audit Metadata