activecampaign
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the @useclawlink/cli tool from the NPM registry to facilitate the ActiveCampaign integration.
- [COMMAND_EXECUTION]: Relies on shell commands to perform login, connection, and data management tasks via the ClawLink CLI.
- [PROMPT_INJECTION]: The skill handles data from ActiveCampaign, creating an attack surface for indirect prompt injection.
- Ingestion points: Untrusted data enters the agent context through ActiveCampaign contacts, lists, campaigns, and automations fetched via CLI commands.
- Boundary markers: No explicit delimiters or instructions are provided to the agent to isolate or ignore instructions embedded within the marketing data.
- Capability inventory: The skill possesses capabilities to execute shell commands (npx) and perform write actions like creating campaigns and automations.
- Sanitization: No sanitization or validation steps are documented for the data retrieved from the ActiveCampaign API.
Audit Metadata