kelly-crm
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources to automate CRM updates and follow-up drafting.\n
- Ingestion points: Untrusted data enters the agent's context through emails, meeting notes, and chat logs which are used to upsert CRM records and generate outreach drafts (identified in SKILL.md).\n
- Boundary markers: The skill instructions lack explicit boundary markers or "ignore embedded instructions" warnings for the external data being interpolated into the agent's prompts.\n
- Capability inventory: The skill has the capability to write to the Busabase data layer and trigger a hand-off of approved follow-ups to external communication skills via a trusted execution script.\n
- Sanitization: There is no evidence of prompt-level sanitization or escaping of external content before processing by the LLM, although the UI components use standard HTML escaping for rendering.\n- [COMMAND_EXECUTION]: The package contains administrative Node.js scripts for workspace setup (setup.mjs), deployment (publish_airapp.mjs), and follow-up execution (execute_decisions.mjs). These scripts are intended for local management by the operator and use standard environment variables for secret management.\n- [EXTERNAL_DOWNLOADS]: The skill relies on standard Node.js dependencies including hono and busabase-sdk, which are fetched from the official npm registry during the installation process.
Audit Metadata