skills/clawlink-hq/skills/gong/Gen Agent Trust Hub

gong

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the npx @useclawlink/cli command to download and execute the ClawLink CLI tool directly from the NPM registry. This package is the official tool provided by the vendor (clawlink-hq) for account management and integration.
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands to log in, connect services, and run actions (e.g., npx @useclawlink/cli run gong). These commands are necessary for the tool's core functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill enables the agent to read and process data from external sales conversations within Gong. This creates a potential surface for indirect prompt injection if those conversations contain malicious instructions designed to influence the agent's behavior.
  • Ingestion points: Data enters the context through npx @useclawlink/cli actions gong and npx @useclawlink/cli run gong commands (SKILL.md).
  • Boundary markers: None explicitly defined in the instructions.
  • Capability inventory: The skill can execute shell commands via the CLI and access local credential files (~/.clawlink/credentials.json).
  • Sanitization: Not specified in the provided instructions; behavior depends on the underlying CLI tool and LLM guardrails.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 05:45 PM