sales-prospecting
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to third-party service providers including Fiber AI (
api.fiber.ai), Hunter, and Abstract Company Enrichment via thempp.paywithlocus.comgateway. These connections are necessary for the skill's core functionality of data retrieval and lead enrichment. - [COMMAND_EXECUTION]: The instructions and examples specify the use of the
selatCLI andselat-payutility to execute the prospecting pipeline and manage payments via the SELAT Router. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by interpolating user-provided parameters directly into JSON request bodies for external API calls.
- Ingestion points: User-supplied parameters such as
companyQuery,jobTitles, anddomaindefined inmanifest.json. - Boundary markers: None; parameters are inserted directly into the JSON structure for the API payload.
- Capability inventory: Performs network POST operations to external endpoints via the payment router.
- Sanitization: There is no evidence of input validation or escaping for the interpolated strings within the provided manifest configuration.
Audit Metadata