launch-speed-to-lead
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
resendand@trigger.dev/sdkpackages for email delivery and task orchestration. These are official packages from well-known services and are used according to standard integration patterns. - [DATA_EXFILTRATION]: Automated emails containing lead information are sent to Resend's API. This is the primary intended function of the skill and uses authenticated requests to a well-known service infrastructure.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted lead data (names, emails, and inquiry details) to populate follow-up templates.
- Ingestion points: Lead data is retrieved from the database using
getLead(leadId)within theleadFollowUptask intrigger/lead-follow-up.ts. - Boundary markers: The skill passes data objects to external React templates (
confirmationEmail,checkInEmail, etc.) for rendering. - Capability inventory: The skill is limited to sending emails via the
sendEmailfunction inlib/send-email.ts(network request to Resend). - Sanitization: Unsubscribe tokens are URL-encoded using
encodeURIComponentto prevent injection into URL structures.
Audit Metadata