salesloft-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate code examples for the SalesLoft REST API v2 (
https://api.salesloft.com/v2/). It correctly instructs users to handle secrets via environment variables (SALESLOFT_API_KEY) and references official developer documentation. - [INDIRECT_PROMPT_INJECTION]: The skill demonstrates how to ingest data from external SalesLoft API endpoints. While this is the intended primary functionality, it represents a standard indirect prompt injection surface where maliciously crafted data within the external SalesLoft account could attempt to influence the agent's behavior.
- Ingestion points: Data retrieved via
api.get('/people.json')andapi.get('/cadences.json')in the code snippets provided inSKILL.md. - Boundary markers: None are present in the example code to delimit external data from agent instructions.
- Capability inventory: The skill frontmatter configures access to
Read,Write,Edit, andBashtools. - Sanitization: The example code does not include validation or sanitization of the data returned from the API.
Audit Metadata