skills/clawlink-hq/skills/jotform/Gen Agent Trust Hub

jotform

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx @useclawlink/cli to download and run the ClawLink CLI from the public NPM registry. This package is managed by the skill's author, clawlink-hq.
  • [COMMAND_EXECUTION]: The skill operates by executing shell commands to log in, connect services, and perform Jotform actions through the CLI tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes data from Jotform (such as form names, label metadata, and user history) which could contain adversarial instructions provided by external users or sources.
  • Ingestion points: Jotform data retrieved via jotform_get_user_forms, jotform_get_user_history, and label-related actions in SKILL.md.
  • Boundary markers: Not specified; the skill does not instruct the agent to use specific delimiters when parsing external data.
  • Capability inventory: The agent has access to shell command execution through the npx command.
  • Sanitization: No explicit sanitization or filtering logic is described for the data ingested from Jotform.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 05:45 PM