skills/sabique-islam/shadowfax/sales/Gen Agent Trust Hub

sales

Pass

Audited by Gen Agent Trust Hub on Aug 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill references the execution of local Node.js scripts to facilitate state management and content validation.\n
  • Evidence: node scripts/run-state-check.js sales in SKILL.md\n
  • Evidence: node skills/write/scripts/lint.js analyze draft.md in SKILL.md\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external, untrusted data (call transcripts), which creates a potential surface for indirect prompt injection.\n
  • Ingestion points: The instructions suggest using 'Evidence' from real calls pasted by the user as input for the drafting process (SKILL.md).\n
  • Boundary markers: There are no explicit delimiters or warnings provided to the agent to ignore embedded instructions within the pasted evidence.\n
  • Capability inventory: The skill references local script execution via Node.js as the primary capability.\n
  • Sanitization: No sanitization or validation steps are described for the processed transcripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 23, 2026, 10:34 AM
Security Audit — agent-trust-hub — sales