basecamp
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npx @useclawlink/clito perform actions in Basecamp. - [EXTERNAL_DOWNLOADS]: The
@useclawlink/clipackage is downloaded from NPM usingnpxduring setup and usage. As a package from the vendor's own namespace, this is standard functionality. - [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes data from external Basecamp actions and uses it to construct subsequent command inputs.
- Ingestion points: Output from
npx @useclawlink/cli actions basecampanddescribecommands in SKILL.md. - Boundary markers: None explicitly defined in the skill instructions to separate external data from instructions.
- Capability inventory: Execution of Basecamp actions via
npx @useclawlink/cli runin SKILL.md. - Sanitization: No explicit sanitization or validation of the Basecamp data is mentioned before it is used to generate JSON input.
Audit Metadata