daily-review
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Node.js script (
node scripts/kpi-audit.js) located within the user's home directory. This script is used for auditing KPI quality as part of the daily review process. - [PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources, creating a surface for indirect prompt injection.
- Ingestion points: The skill retrieves data from a Supabase database (opportunities, tasks, and activity tables) and external marketing platforms (HeyReach and Instantly).
- Boundary markers: There are no explicit delimiters or boundary markers defined in the instructions to prevent the agent from interpreting retrieved data as instructions.
- Capability inventory: The agent has the capability to execute shell commands (
node) and generate structured reports based on the ingested data. - Sanitization: The skill lacks explicit sanitization or filtering logic for the data retrieved from the CRM or APIs before it is incorporated into the daily review summary.
Audit Metadata