nooks-dial-prep
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill includes a 'Verified roster' containing hardcoded production identifiers for specific employees, including 'HubSpot owner_id' (e.g., 87486452, 93367782) and 'Nooks user id' (e.g., UdhD9yeRfOXij75iD0Oy9F1b25P2, U2iWVwWG83OYhm3XR0mvGd9gWDV2). Hardcoding specific user mapping IDs in the instruction file is a poor security practice.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple external sources to generate battlecards.
- Ingestion points: Data is pulled from Nooks tasks/prospects (
listTasks,getProspect), HubSpot deals (hubspot_search_deals), and Apollo organization enrichment (apollo_organizations_enrich). - Boundary markers: The instructions lack explicit delimiters or markers to separate prospect-supplied data (like company descriptions or titles) from the agent's instructions.
- Capability inventory: The agent has capabilities to send Slack messages (
slack_send_message), write to local HTML files, and access CRM/dialer APIs. - Sanitization: While the skill mentions
check_my_copyfor the call opener, it does not specify sanitization or escaping for other interpolated data points like account intel or company descriptions. - [DATA_EXFILTRATION]: The skill aggregates sensitive business intelligence, including order history ('biggest order', 'average order value', 'lifetime total'), deal stages, and device deployment telemetry ('Pearl/Epiphan devices deployed'). This data is formatted into HTML files and sent to Slack DMs, which could lead to unauthorized data exposure if the running environment is compromised.
Recommendations
- AI detected serious security threats
Audit Metadata