biz-dev-lawful-prospecting-outreach
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is a comprehensive set of business process guidelines focused on compliance with East African and European data protection laws. It promotes ethical outreach practices, such as providing clear opt-out routes, verifying lawful bases for contact, and adhering to platform-specific policies (e.g., WhatsApp Business Messaging Policy). The skill's design limits the agent's actions to analysis and drafting, requiring explicit human authority for any live operations.
- [INDIRECT_PROMPT_INJECTION]: The skill includes instructions for auditing external digital assets, such as prospect websites and social media profiles, which could potentially serve as vectors for indirect instructions embedded in third-party content.
- Ingestion points: The audit workflow in
references/personalised-video-outreach.md(Step 1) requires the agent to examine external URLs, Facebook Pages, Instagram accounts, and Google Business Profiles. - Boundary markers: The instructions do not specify technical delimiters or boundary markers to isolate untrusted audit data from the agent's primary instructions.
- Capability inventory: The skill is restricted to read and search capabilities for analysis; it explicitly states that publishing, sending messages, or processing personal data requires action-specific client authority.
- Sanitization: The workflow relies on manual quality controls, specifically an 'ethics filter' and an 'anti-slop gate', to review message drafts for accuracy and compliance before they are finalized.
Audit Metadata