champion-move-outreach
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues or malicious patterns were identified in the skill's instructions or metadata.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from untrusted external sources (web search results, professional profile data) to generate personalized outreach. While this is an inherent attack surface for indirect prompt injection, the skill follows safety best practices by requiring explicit human approval for all findings and drafts before taking any external action.
- [DATA_EXPOSURE]: The skill manages professional PII, including contact names and employment history. This data handling is transparently described as the skill's primary purpose and relies on user-configured external tools (e.g., Apollo, Clearbit) and standard storage paths for configuration. No evidence of unauthorized data exfiltration was found.
- [COMMAND_EXECUTION]: The skill uses high-level agent capabilities like web-search and email-drafting. It does not attempt to execute arbitrary shell commands or access sensitive system files.
Audit Metadata