find-companies
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data retrieved through the OpenFunnel API, introducing a potential surface for indirect prompt injection.
- Ingestion points: Data enters the context via the /api/v1/signal/ and /api/v2/account/batch endpoints in SKILL.md.
- Boundary markers: The instructions do not define delimiters or specific warnings for the agent when processing or presenting this external data.
- Capability inventory: The skill performs network API requests and local file system writes to the .env file.
- Sanitization: No sanitization or verification of the external data content is specified before it is presented to the agent.
Audit Metadata