install-base-expansion-engine-skill
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [DATA_EXFILTRATION]: The skill is configured to write and read data from paths in the user's home directory, specifically within
~/.claude/skill-analytics/and~/.claude/skill-runs/. While intended for analytics, writing outcome data outside the repository boundary is a data handling concern. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources (Stripe usage trends, CRM order history, and Apollo lead enrichment) and interpolates this content directly into prompts used to generate 'MEDDIC expansion plays' and HubSpot task notes. The lack of explicit boundary markers or sanitization logic creates a surface where malicious content in external databases could influence agent behavior.
- Ingestion points:
analytics_search_by_email(registrations),ask_agent(Stripe cloud usage),crm_get_customer_orders(revenue history), andapollo:enrich-lead(contact metadata). - Boundary markers: No delimiters or safety instructions are specified for the interpolation of external data into generated copy.
- Capability inventory:
hubspot_create_contact_task,hubspot_create_contact_note,xlsxworkbook generation, and local file writing. - Sanitization: No escaping or validation procedures are defined for the ingested data before it is processed by the LLM.
- [METADATA_POISONING]: There is a discrepancy between the system-provided author context and the internal skill metadata. The skill identifies the author as 'Tim Kipper', which deviates from the expected author identifier, potentially misleading users about the skill's origin.
Audit Metadata