sales-nav-search-builder
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The workflow requires the agent to build a JSON spec and pipe it to a local Python script via a bash command string (
echo '<JSON_SPEC>' | python3 scripts/build_url.py -). If the agent fails to properly escape single quotes or shell metacharacters when interpolating user data into the<JSON_SPEC>, it creates an execution surface susceptible to shell breakout. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection risk surface due to the processing of untrusted user input combined with script execution capabilities. Below is the mandatory evidence chain:
- Ingestion points: User-supplied natural-language Ideal Customer Profile (ICP) descriptions enter the context through queries processed under
SKILL.md. - Boundary markers: Absent from the prompt instructions. There are no explicit delimiters or rules directing the agent to isolate or ignore embedded instructions within the user input before rendering the JSON spec.
- Capability inventory: Evaluates and processes data locally by executing
scripts/build_url.pyvia shell command line invocation. - Sanitization: The
scripts/validate_boolean.pyfile validates boolean operators, length constraints, and syntax errors, but does not sanitize the upstream shell interpolation context handled by the agent.
Audit Metadata