pre-meeting-brief
Fail
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: CRITICALMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill metadata identifies "Builder.org" as the author, a domain explicitly flagged as blacklisted by automated security scanners. Additionally, the SKILL.md file has been flagged by file reputation scanners as potentially malicious (FileRepMalware). This metadata is also inconsistent with the identified skill author 'onstartups'.
- [INDIRECT_PROMPT_INJECTION]: The skill workflow fetches data from external, untrusted sources including HubSpot CRM records and web research results to generate a meeting brief. The absence of sanitization or boundary markers creates a vulnerability to indirect prompt injection. * Ingestion points: HubSpot API records (contacts, engagements, deals) and external web search results. * Boundary markers: None present in the workflow or output template to isolate untrusted data. * Capability inventory: Read access to HubSpot CRM and web research tools. * Sanitization: No evidence of data sanitization or escaping for external content was found.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata