gong
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests external Gong transcript data, creating a surface for indirect prompt injection.
- Ingestion points: Call transcripts and metadata are fetched via the
gong-callsandaccount-deep-divetools as specified inSKILL.md. - Boundary markers: The instructions do not define specific delimiters for separating ingested transcript content from the agent's instructions.
- Capability inventory: The skill utilizes the
run-code,save-analysis, andprovider-api-requestcapabilities. - Sanitization: Instructions specifically mandate filtering monologues to isolate customer speech and using compact excerpts to minimize the processing of raw external data.
- [COMMAND_EXECUTION]: The skill directs the agent to use the
run-codetool for data processing tasks, including joining datasets, deduplicating information, and formatting evidence. This usage is restricted to internal data manipulation consistent with the skill's purpose.
Audit Metadata