lookalike-customer-finder-skill
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted customer names provided by the user and processes them to generate complex market analysis. This creates a surface where malicious instructions embedded in company names could influence agent behavior.
- Ingestion points: User-supplied customer names in triggers like 'find companies like [customer names]' and during ICP derivation.
- Boundary markers: Absent. The instructions do not provide specific delimiters or 'ignore' instructions for the agent when processing the external customer data.
- Capability inventory: The agent uses research tools to find firmographic/technographic data and has file-writing capabilities to generate reports and telemetry sidecars.
- Sanitization: Absent. No mention of input validation or escaping for the customer-provided strings is found in the workflow.
- [COMMAND_EXECUTION]: The skill instructs the agent to write a JSON 'outcome sidecar' to a specific hidden file path at the end of the workflow.
- Evidence: The instruction mandates writing telemetry to
~/.claude/skill-analytics/last-outcome-lookalike-customer-finder.json. - Note: While likely intended for platform-level telemetry or session tracking, instructions to write files to hidden user directories (~/.*) represent a side-effect that persists beyond the immediate interaction.
Audit Metadata