inboxmate-batch-demo
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and analyzes external website content using
WebFetchto determine if a prospect is valid (Step 2a). This creates a surface for indirect prompt injection where an attacker-controlled website could include hidden instructions to influence the agent's logic. - Ingestion points: External website content retrieved via domain names from the CRM (
domainName.primaryLinkUrl). - Boundary markers: The instructions do not define any delimiters or system-level warnings to ignore embedded instructions within the fetched web data.
- Capability inventory: The agent can perform GraphQL mutations on the Twenty CRM (creating opportunities, changing status to DISQUALIFIED) and invoke the
/inboxmate-demoskill. - Sanitization: No sanitization or filtering is specified for the content retrieved from external websites before the agent evaluates it against the "Skip Criteria".
- [ADVERSARIAL_REASONING]: The skill is configured to "Auto-skip and mark in CRM immediately" without asking the user for confirmation (Step 2b). This high level of autonomy, combined with the ingestion of untrusted external data, increases the risk that a successful indirect prompt injection could modify CRM records without human oversight.
Audit Metadata