company-enrichment
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill communicates with api.leadmagic.io and mcp.leadmagic.io. These are official vendor domains for the LeadMagic enrichment service and are consistent with the skill's primary purpose. Instructions demonstrate using the X-API-Key header with a shell variable ($LEADMAGIC_API_KEY), which follows security best practices for credential management.
- [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface through fields like company_domain, company_name, and profile_url. These inputs are used to query external APIs. While the skill lacks explicit boundary markers or sanitization logic for these inputs, the context is limited to data enrichment queries, posing no identified risk of agent subversion.
- Ingestion points: Input fields company_domain, company_name, and profile_url in SKILL.md.
- Boundary markers: Not present.
- Capability inventory: Network requests (curl) to LeadMagic APIs.
- Sanitization: Not present.
- [COMMAND_EXECUTION]: The skill provides curl command examples for interacting with the API. These commands are informational and are used to demonstrate standard API interaction patterns rather than performing unauthorized system operations.
Audit Metadata