gong
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the '@useclawlink/cli' package from the NPM registry via npx. This is the primary interface for the integration provided by the vendor.- [COMMAND_EXECUTION]: The skill relies on shell command execution to perform tasks such as logging in, connecting to Gong, and running specific actions. This provides the agent with the ability to interact directly with the operating system's shell.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data retrieved from sales conversations in Gong.
- Ingestion points: External data is ingested through command outputs when running 'npx @useclawlink/cli run gong'.
- Boundary markers: The instructions include a behavioral guideline to confirm with the user before performing write actions, but no technical markers or delimiters are used to isolate ingested data from agent instructions.
- Capability inventory: The agent has the capability to execute shell commands and file system operations via the CLI tool.
- Sanitization: There is no explicit sanitization or filtering mentioned for the data retrieved from Gong before it is processed by the agent.
Audit Metadata