inbound-speed-to-lead-skill
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by ingesting untrusted data from external inbound leads and interpolating that data into agent prompts and tool calls.
- Ingestion points: Untrusted lead data enters the context through
hubspot_search_contactsand user-provided lead details in theSingle-leadmode described in the workflow. - Boundary markers: The instructions lack explicit boundary markers or directives telling the agent to treat lead-supplied content as data rather than instructions.
- Capability inventory: The skill has the capability to write Gmail drafts (
create_draft), send Slack messages (slack_send_message), and modify CRM records (hubspot_create_contact_note). - Sanitization: There is no evidence of security-specific sanitization or filtering of lead data before it is used in outgoing communications or subsequent agent reasoning steps.
- [INDIRECT_PROMPT_INJECTION]: In Gate E, the skill performs a tool call that interpolates the
{email_domain}directly into a natural language query for another agent:ask_agent("Does {email_domain} have Pearl devices..."). This specific pattern is vulnerable to tool output poisoning if a malicious actor controls the domain name or associated registrant metadata.
Audit Metadata