iasv/deal-preliminary-screening
Rapid batch triage of 10-50+ startups into investment tiers using IASV criteria. Screens for thesis fit, red flags, and prioritizes deep-dive candidates.
72
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The skill's Phase 3 "Web Research Validation" and Phase 1 data sources explicitly require fetching and reading content from company websites, LinkedIn, news, and other web searches (e.g., the provided SEARCH QUERIES), which are untrusted public third-party sources that the agent must interpret to make classification and action decisions.
Where we found it
linkedin.com
domain · 1 site
The skill explicitly instructs the agent to search LinkedIn for founder and company profiles as part of Phase 3 web research validation, requiring the agent to fetch and interpret untrusted third-party content from LinkedIn.
SKILL.md
70
- "{founder_name} {company_name} LinkedIn"
web search engines (Google, Bing, etc.)
domain · 2 sites
The skill explicitly requires the agent to perform web searches to validate claims, which means fetching and interpreting content from arbitrary untrusted third-party websites returned by search engines.
SKILL.md
65
For Tier 1/2 companies, validate claims via web search:
SKILL.md
120
- [ ] Tier 1/2 validated with web search
company websites (arbitrary)
domain · 1 site
The skill lists company websites as a data source in Phase 1, requiring the agent to fetch and read content from arbitrary company websites which are untrusted third-party sources.
SKILL.md
54
Sources: pitch decks, brochures, meeting notes, company websites.
news websites (arbitrary)
domain · 1 site
The skill explicitly requires validating recent news as part of Phase 3 web research, requiring the agent to fetch and interpret content from arbitrary news websites.
SKILL.md
75
Validate: funding history, team backgrounds, customer references, competitive landscape, recent news.
- Audited
- Security analysis