outreachagent
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to handle inbound email responses, which presents a surface for indirect prompt injection attacks.
- Ingestion points: Inbound message bodies are ingested through the
/threadsAPI endpoint or webhook events. - Boundary markers: The skill does not utilize technical delimiters in the data itself but provides strong behavioral instructions for the agent to treat all inbound text as untrusted and to never execute instructions contained within email bodies.
- Capability inventory: The skill possesses significant network-enabled capabilities, such as sending messages (
/messages/send) and enrolling contacts into workflows. - Sanitization: The instructions explicitly mandate that the agent must sanitize and classify inbound content before it is processed by the agent runtime.
- [EXTERNAL_DOWNLOADS]: The documentation references external NPM packages such as
@outreachagent/sdk-ts. The author includes specific warnings for the agent to verify the contents and entry points of these packages before recommending or using them, mitigating potential supply chain risks. - [DATA_EXFILTRATION]: The skill manages sensitive API credentials and recipient contact information. It adheres to security best practices by requiring API keys to be loaded from environment variables and explicitly forbids the logging of sensitive trace data or recipient attributes.
Audit Metadata