connect-ai-bullhorncrm
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data from Bullhorn CRM tables, creating a surface for indirect prompt injection attacks.
- Ingestion points: Data is ingested from various Bullhorn tables such as
Candidate,JobOrder,JobSubmission, andNote, specifically through fields likeJobDescription,Comments, andNotebody content. - Boundary markers: The instructions encourage the use of SQL quoting (e.g.,
[Open/Closed]) and explicit schema referencing, which provides structural boundaries, though it lacks explicit warnings to ignore embedded instructions in the retrieved data. - Capability inventory: The skill has capabilities to execute database queries (
SELECT,INSERT,UPDATE) and retrieve file content via theDownloadFilestored procedure. - Sanitization: Identifiers are sanitized using square bracket quoting, but there is no specific instruction for sanitizing or filtering the content of text fields retrieved from the CRM.
Audit Metadata