early-access-email-sequence
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill researches signups by performing web searches and fetching content from external company domains. This untrusted content is then used to generate personalized emails and populate a Notion database, which presents an indirect prompt injection risk if the external content contains malicious instructions.
- Ingestion points: Data is ingested from
WebSearchresults (LinkedIn profiles) andWebFetchof the user-providedcompany_domain(SKILL.md, Phase 1 & 2). - Boundary markers: The skill does not define any delimiters or provide instructions for the agent to ignore potentially malicious embedded content within the fetched data.
- Capability inventory: The agent uses
WebSearch,WebFetch, and Notion MCP tools (notion-create-pages,notion-create-database) to research and output data. - Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from external web sources before it is used in email generation or Notion updates.
- [EXTERNAL_DOWNLOADS]: The skill uses
WebFetchto retrieve data from arbitrary, non-whitelisted domains provided as thecompany_domaininput (SKILL.md, Phase 2).
Audit Metadata