sales-compete
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Mentions the LeadMagic API (api.leadmagic.io) and provides an installation command for a related skill via npx. These resources are consistent with the vendor's ('sales-skills') stated identity and the skill's purpose.
- [DATA_EXFILTRATION]: The skill manages a local state file (references/learnings.md) to accumulate knowledge. This is a common pattern for agent self-improvement and does not constitute unauthorized data exposure.
- [PROMPT_INJECTION]: The skill ingests external data from references/learnings.md and user-provided inputs. While it lacks explicit boundary markers or sanitization for this data, the capability is limited to standard workflow suggestions, posing a low risk of indirect prompt injection. Mandatory evidence: 1. Ingestion points: references/learnings.md and user inputs; 2. Boundary markers: Absent; 3. Capability inventory: File system write/read and suggested npx command usage; 4. Sanitization: Absent.
Audit Metadata