gorgias
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the
@useclawlink/clivianpxto perform authentication, action discovery, and ticket management tasks. These commands interact with the vendor's hosted services to manage Gorgias data. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to read data from Gorgias tickets and customer profiles, which are external sources that could contain untrusted instructions.
- Ingestion points: Data is ingested through commands like
npx @useclawlink/cli run gorgias <action-id>which retrieve ticket content or customer information. - Boundary markers: None explicitly defined; however, the skill includes a directive to "confirm with the user before any write."
- Capability inventory: The skill uses the CLI to execute actions, which includes the ability to perform network requests and modify remote data in Gorgias.
- Sanitization: There are no explicit instructions for the agent to sanitize or filter the retrieved data for embedded instructions.
Audit Metadata