linkedin-reply-handler
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from LinkedIn comments to generate automated replies, creating a potential attack surface for indirect prompt injection.
- Ingestion points: Data enters the context via
lib.ApifyClient.fetch_post_commentsandlib.ApifyClient.fetch_postas described inSKILL.md(Steps 2 and 3). - Boundary markers: The skill includes a dedicated "Untrusted content" section in
SKILL.mdwhich explicitly instructs the agent to treat fetched text as data rather than instructions and to ignore any directions embedded in comments. - Capability inventory: The skill possesses write capabilities through the
lib.publishfunction, which can post replies and reactions to LinkedIn. - Sanitization: The skill relies on LLM instruction-following to sanitize input, specifically flagging potential prompt-injection attempts in the filter summary rather than using programmatic sanitization.
Audit Metadata