launch-speed-to-lead

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the resend and @trigger.dev/sdk packages for email delivery and task orchestration. These are official packages from well-known services and are used according to standard integration patterns.
  • [DATA_EXFILTRATION]: Automated emails containing lead information are sent to Resend's API. This is the primary intended function of the skill and uses authenticated requests to a well-known service infrastructure.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted lead data (names, emails, and inquiry details) to populate follow-up templates.
  • Ingestion points: Lead data is retrieved from the database using getLead(leadId) within the leadFollowUp task in trigger/lead-follow-up.ts.
  • Boundary markers: The skill passes data objects to external React templates (confirmationEmail, checkInEmail, etc.) for rendering.
  • Capability inventory: The skill is limited to sending emails via the sendEmail function in lib/send-email.ts (network request to Resend).
  • Sanitization: Unsubscribe tokens are URL-encoded using encodeURIComponent to prevent injection into URL structures.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 06:01 AM