inboxmate-batch-demo
Warn
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: Accesses the
.envfile in the current working directory to retrieve sensitive API tokens, includingPSQUARED_CRM_TOKEN,NUXT_MCP_DEMO_TOKEN, andOPENBRAND_API_KEY. While necessary for functionality, this involves access to a sensitive configuration file path. - [EXTERNAL_DOWNLOADS]: Uses
WebFetchto retrieve content from third-party prospect domains to determine their suitability for demo creation based on various skip criteria. - [COMMAND_EXECUTION]: Automates data modification via GraphQL mutations on the Twenty CRM at
https://crm.psquared.dev/graphqland invokes the/inboxmate-demoskill to update prospect records without human-in-the-loop confirmation. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through external web content retrieved during the validation step.
- Ingestion points: Fetches content from prospect domains using
WebFetch(SKILL.md). - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present when processing fetched content.
- Capability inventory: Performs CRM updates and triggers external demo pipelines (SKILL.md).
- Sanitization: No evidence of content sanitization or validation of the content fetched from external domains.
Audit Metadata