lead-handoff-sla
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted lead exports from CRM systems (ingestion point: cfg.leads in resources/handoff-sla.js). While no explicit boundary markers are used in the prompt interpolation, the risk is mitigated because the analysis script lacks dangerous capabilities like network access, subprocess execution, or filesystem writes. The script performs safe sanitization by parsing inputs into numeric and date types for calculation purposes.
- [COMMAND_EXECUTION]: The skill utilizes a local Node.js script (resources/handoff-sla.js) to process data. This script is self-contained, does not use external packages, and does not perform any high-risk operations such as arbitrary code execution or persistence, serving as a safe utility for data analysis.
Audit Metadata