first-touch-follow-up
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill functions by interpolating external content (the lead's message) directly into a prompt template. This creates a surface for indirect prompt injection where a malicious lead message could attempt to influence the agent's output.
- Ingestion points: External data is ingested via the 'The lead's message or details' placeholder in
SKILL.md. - Boundary markers: The prompt uses headers but lacks robust delimiters (like XML tags) or specific instructions to the agent to disregard commands within the input.
- Capability inventory: The skill is restricted to text generation; it has no access to tools, filesystem, network, or subprocesses.
- Sanitization: The skill does not implement input sanitization or filtering for the lead's message.
- [NO_CODE]: The skill consists entirely of natural language instructions and prompt templates. No scripts, binaries, or automated tool configurations are present, significantly reducing the potential attack surface.
Audit Metadata