sales-client-sourcing
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted participant data from Google Sheets (company names, AI challenges, topic interests) to generate sales strategies and company background summaries.
- Ingestion points: Data is read from the
company_col,challenges_col, andtopics_colusingmcp__google-workspace__read_sheet_valuesin Steps 1, 2, and 5. - Boundary markers: The skill does not define specific boundary markers or 'ignore' instructions for the data read from the spreadsheet.
- Capability inventory: The skill uses the
WebSearchtool to look up companies andmcp__google-workspace__modify_sheet_valuesto write synthesized strategies and data back to the Google Sheet. - Sanitization: There is no evidence of input validation or sanitization for the external survey content before it is processed by the AI to create the '陌生開發策略' (Cold-outbound strategy).
- [REMOTE_CODE_EXECUTION]: The documentation includes an installation command using
npxto fetch the skill builder from the author's GitHub repository. While this is an external reference, it is a standard installation pattern for this platform and originates from the vendor's own repository.
Audit Metadata