intent-signal-aggregator-skill
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to aggregate and process data from untrusted external sources such as job postings, tech news, and funding announcements. This creates a surface for indirect prompt injection where malicious instructions hidden in these sources could influence the agent's behavior.
- Ingestion points: The workflow in
SKILL.mdinstructs the agent to monitor "job postings, tech changes, funding rounds, and leadership changes" across the web. - Boundary markers: Absent. The instructions do not define delimiters for external content or provide explicit warnings to the agent to ignore instructions embedded within the scraped data.
- Capability inventory: The skill utilizes HubSpot integration tools (
mcp__claude_ai_Epiphan_Ai__hubspot_search_companies) and performs local file system writes to the~/.claude/skill-analytics/directory. - Sanitization: Absent. There is no logic provided to filter or escape instructions found in external data before processing.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill generates and writes an 'outcome sidecar' containing execution metrics and status to a hidden local directory (
~/.claude/skill-analytics/). While intended for telemetry, this establishes a pattern of writing agent-controlled data to the local file system.
Audit Metadata