lead-hand-skill
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites which could contain malicious instructions.\n
- Ingestion points: Phase 3 and Phase 4 of the system prompt in
HAND.tomluseweb_searchandweb_fetchto ingest data from unknown external websites.\n - Boundary markers: The prompt does not specify delimiters or instructions to ignore commands within the fetched content, which could lead the model to follow instructions embedded in third-party websites.\n
- Capability inventory: The agent possesses powerful capabilities including
shell_exec,file_write, andfile_read, increasing the potential impact if a prompt injection attack is successful.\n - Sanitization: The skill lacks validation or sanitization of content retrieved from the web before it is used for lead enrichment.\n- [DYNAMIC_EXECUTION]: The skill uses dynamic execution to detect the operating system.\n
- Evidence: Phase 0 in
HAND.tomlinstructs the agent to execute a Python command (python -c "import platform; print(platform.system())") viashell_execto determine the host platform.
Audit Metadata