gorgias
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
@useclawlink/clitool usingnpxto perform login, connection, and action tasks within Gorgias. - [CREDENTIALS_UNSAFE]: The documentation identifies that credentials will be stored at
~/.clawlink/credentials.json. This is a standard practice for CLI applications to manage user tokens locally and does not involve hardcoding secrets. - [EXTERNAL_DOWNLOADS]: The skill triggers the download of the
@useclawlink/clipackage from the public NPM registry at runtime vianpxcommands. - [PROMPT_INJECTION]: The skill processes data from Gorgias (e.g., support tickets) which may contain untrusted content from external users, creating a surface for indirect prompt injection. Ingestion points: Gorgias ticket data; Boundary markers: Absent; Capability inventory: Shell command execution; Sanitization: Absent.
Audit Metadata