recoup-internal-consulting-linkedin-engage
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
pythonto execute local scripts likefind_posts.pyfor outbound target discovery and content searching. This is part of the skill's core functionality for gathering data from external sources. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external LinkedIn posts to generate draft engagement angles. This creates an attack surface where instructions embedded in social media content could attempt to influence the agent's behavior.
- Ingestion points: Content from social media posts retrieved via
find_posts.py, Attio CRM data, and local lead enrichment files (*-enriched.json). - Boundary markers: The instructions do not define specific delimiters or "ignore" instructions for the agent when processing the content of the posts.
- Capability inventory: The skill can execute local Python scripts, read various workspace files, and write output files to the
integrations/linkedin/engagement/directory. - Sanitization: There is no evidence of sanitization or filtering of the external content before it is processed by the LLM.
- Mitigation: The risk is significantly reduced by the human-in-the-loop requirement; the agent only provides a queue and angles, while the user writes and posts the actual comments.
Audit Metadata