get-qualified-leads-from-luma
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external Luma event pages (attendee names, bios, and titles) and passes this content directly into LLM prompts for lead qualification in Step 3. A malicious attendee profile containing prompt injection instructions could influence the qualification reasoning or output.
- Ingestion points: Luma event scraping in Step 1 (
skills/luma-event-attendees/scripts/scrape_event.py). - Boundary markers: The skill suggests including batches of leads as JSON, but does not specify strict delimiters or escaping for the data fields within the qualification prompt.
- Capability inventory: File system access (
/tmp/*.csv,/tmp/*.json), network operations (Slack webhook), and Google Sheets writing. - Sanitization: No explicit sanitization or filtering of the scraped bio/title content is mentioned before it is processed by the qualification agent.
- [DATA_EXFILTRATION]: In Step 5, the skill uses Python's
urllib.requestto send lead data (names, LinkedIn URLs, and qualification reasoning) to an external Slack webhook URL provided by the user. While this is a functional requirement, it represents a network exfiltration vector for data stored in the agent's temporary context. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to run scraping scripts (e.g.,
python3 skills/luma-event-attendees/scripts/scrape_event.py) and perform parallel searches. It also provides a Python code block for the agent to execute to handle network requests. - [EXTERNAL_DOWNLOADS]: The skill relies on external services and MCP tools (Apify for scraping, Rube MCP for Google Sheets and Slack) to function, which involves interaction with third-party APIs and infrastructure.
Audit Metadata