zoho-crm
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill facilitates reading and processing data from Zoho CRM (such as contacts, leads, and notes) which could contain malicious instructions designed to manipulate the agent's behavior.
- Ingestion points: Data retrieved from Zoho CRM through Apideck's CRM API endpoints (e.g.,
apideck.crm.contacts.list). - Boundary markers: The instructions do not specify the use of delimiters or warnings to treat retrieved CRM data as untrusted content.
- Capability inventory: The skill allows the agent to read, write, and search CRM records, and includes a Proxy API for executing arbitrary requests to Zoho CRM endpoints.
- Sanitization: No explicit data sanitization or validation routines are defined for the content retrieved from the CRM.
- [SAFE]: Credential Handling. The skill correctly instructs the use of environment variables (
APIDECK_API_KEY,APIDECK_APP_ID) to manage sensitive API credentials, preventing hardcoded secrets. - [SAFE]: Network Security. All network operations and documentation references are directed toward official Apideck (
apideck.com) and Zoho CRM (zoho.com) domains.
Audit Metadata