lead-generating

• Analyzed: May 12, 2026, 3:07 AM
• Findings: 1
• Version: 1.0.0
• Hash: 0831bc87bf6b18be1c1bea49af731675f489dab3f562efac75b1f5a7391d71b6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for lead management using Supabase and Make.com. It requires a Supabase Service Role Key, which grants full database access, but this is explicitly stated in `SKILL.md` and `skill.json` and is necessary for the skill's stated purpose. The `src/api.ts` code exclusively interacts with the configured Supabase instance for CRUD operations on lead and conversation data, consistently applying `org_id` filters for multi-tenancy. There is no evidence of data exfiltration to unauthorized endpoints, arbitrary command execution, persistence mechanisms, or prompt injection attempts against the agent to perform actions beyond its declared functionality. The `lead.delete` capability is present but is a standard CRUD operation for a lead management system.