lead-enrichment
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill's behavior is transparent and aligns with its stated purpose of lead enrichment.
- [EXTERNAL_DOWNLOADS]: The skill communicates with external data providers (Hunter, Apollo, and Clado) via subdomains of paywithlocus.com. These network operations are necessary for the enrichment process and are documented in the skill's references.
- [COMMAND_EXECUTION]: The skill instructions utilize the
selatandselat-payCLI tools to install and run the workflow, including the use of a--probe-onlyflag for verification before payment. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by processing external lead data and user-supplied parameters.
- Ingestion points: User parameters in
manifest.json(firstName,lastName,company,domain,email,linkedinUrl) and response data from enrichment APIs. - Boundary markers: Absent; the skill relies on standard JSON interpolation for API requests.
- Capability inventory: HTTP POST requests via the
selat-paytool to specified merchant endpoints. - Sanitization: No explicit sanitization or filtering of input or output data is performed within the skill definition.
Audit Metadata