boldsign
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto download and run the@useclawlink/clipackage. This is a legitimate utility from the vendor associated with the skill author. - [COMMAND_EXECUTION]: The agent is directed to execute shell commands to manage authentication and document workflows in Boldsign.
- [INDIRECT_PROMPT_INJECTION]: The skill takes user input and processes external Boldsign data as command arguments, which provides a surface for indirect prompt injection.
- Ingestion points: Task descriptions passed to the CLI and results returned from Boldsign actions (SKILL.md).
- Boundary markers: None identified in the skill instructions.
- Capability inventory: Shell command execution.
- Sanitization: Not specified in the provided text.
Audit Metadata