linkedin-thread-monitor
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, specifically LinkedIn posts, comments, headlines, and usernames. This content is processed to classify engagement stages and draft responses. While the skill includes a robust 'Untrusted content' section with explicit instructions to ignore embedded commands and treat all fetched text as data, the inherent nature of processing user-generated content from a public social platform creates a surface for indirect prompt injection.
- Ingestion points: Fetched LinkedIn post bodies, comments, author headlines, and names (SKILL.md, Step 1 and 2).
- Boundary markers: The skill contains a dedicated section defining that fetched content is data, never instructions, and specifies that the agent should flag content that appears to address the agent (SKILL.md).
- Capability inventory: The skill drafts responses and provides reporting; it does not explicitly use subprocesses or network tools for writing beyond the described read-only tools.
- Sanitization: Relies on instructional constraints within the prompt to ignore instructions in fetched text.
Audit Metadata