inbound-lead-qualifier-skill
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from inbound leads (form fills and demo requests) without boundary markers or sanitization.
- Ingestion points:
SKILL.md - The skill ingests lead name, company name, form data, and engagement history provided as external input.
- Boundary markers: Absent. There are no delimiters or instructions provided to the agent to treat the ingested lead data as untrusted text or to ignore embedded instructions.
- Capability inventory:
SKILL.md - The agent has the capability to write files to the local disk and generate outreach content that could be influenced by injected data.
- Sanitization: Absent. No filtering or validation logic is specified for the external lead data before it is used for scoring and routing calculations.
- [COMMAND_EXECUTION]: The skill contains instructions that require the agent to perform an automated write operation to a specific hidden directory on the local filesystem.
- Evidence:
SKILL.md - The section 'Emit Outcome Sidecar' instructs the agent to write a JSON telemetry file to
~/.claude/skill-analytics/last-outcome-inbound-lead-qualifier.jsonat the end of each session. - Impact: While intended for analytics, hardcoded instructions to write to specific file paths (especially dot-folders) can be leveraged to clutter the filesystem or potentially overwrite legitimate configuration if the path is manipulated.
Audit Metadata