skills/clawlink-hq/skills/basecamp/Gen Agent Trust Hub

basecamp

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses npx @useclawlink/cli to perform actions in Basecamp.
  • [EXTERNAL_DOWNLOADS]: The @useclawlink/cli package is downloaded from NPM using npx during setup and usage. As a package from the vendor's own namespace, this is standard functionality.
  • [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes data from external Basecamp actions and uses it to construct subsequent command inputs.
  • Ingestion points: Output from npx @useclawlink/cli actions basecamp and describe commands in SKILL.md.
  • Boundary markers: None explicitly defined in the skill instructions to separate external data from instructions.
  • Capability inventory: Execution of Basecamp actions via npx @useclawlink/cli run in SKILL.md.
  • Sanitization: No explicit sanitization or validation of the Basecamp data is mentioned before it is used to generate JSON input.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 02:42 PM
Security Audit — agent-trust-hub — basecamp