contacts-and-crm
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions for resolving contact information via the Google People API and enriching that data with CRM context from HubSpot. It correctly directs the agent to use user-configured API keys and platform-specific tools (
find-contact,get-hubspot-contact,provider-api-request).- [PROMPT_INJECTION]: The skill processes untrusted data from external sources such as contact names, email bodies, and CRM deal descriptions. While this represents a surface for indirect prompt injection, the instructions include specific guidance to prevent the agent from inventing data (e.g., 'do not invent an email address') and to report API errors transparently rather than hallucinating missing data. Mandatory Evidence Chain: 1) Ingestion points:find-contact(Google Contacts),get-hubspot-contact(HubSpot deals/tickets). 2) Boundary markers: Absent. 3) Capability inventory:provider-api-request(HubSpot API). 4) Sanitization: Managed by the underlying provider API implementation.
Audit Metadata