prospecting

Pass

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [SAFE]: No malicious patterns, obfuscation, or security vulnerabilities were detected in the skill's instructions, metadata, or reference files. The skill includes strong emphasis on compliance (GDPR, CAN-SPAM) and platform terms of service.
  • [PROMPT_INJECTION]: The skill has a potential surface for indirect prompt injection due to its core function of ingesting data from external sources for lead qualification.
  • Ingestion points: Public discourse from platforms like Reddit, Hacker News, and X, as well as business websites and GitHub issues (identified in references/demand-signals.md and references/local-prospecting.md).
  • Boundary markers: The skill relies on compliance guardrails and a manual review posture rather than technical delimiters for ingested text.
  • Capability inventory: The skill utilizes various MCP tools for data enrichment (Apollo, Clay, ZoomInfo) and has the capability to generate CSV files.
  • Sanitization: Instructions in references/demand-signals.md specifically direct the agent to 'Quote minimally, paraphrase by default' when analyzing external pain signals, which mitigates risks from malicious content in ingested data.
  • [EXTERNAL_DOWNLOADS]: The skill references legitimate integrations with well-known and trusted B2B data services including Apollo, ZoomInfo, Clay, Clearbit, and Truelist. These are industry-standard tools and do not involve suspicious remote code execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 1, 2026, 07:44 AM