jotform
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx @useclawlink/clito download and run the ClawLink CLI from the public NPM registry. This package is managed by the skill's author, clawlink-hq. - [COMMAND_EXECUTION]: The skill operates by executing shell commands to log in, connect services, and perform Jotform actions through the CLI tool.
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes data from Jotform (such as form names, label metadata, and user history) which could contain adversarial instructions provided by external users or sources.
- Ingestion points: Jotform data retrieved via
jotform_get_user_forms,jotform_get_user_history, and label-related actions in SKILL.md. - Boundary markers: Not specified; the skill does not instruct the agent to use specific delimiters when parsing external data.
- Capability inventory: The agent has access to shell command execution through the
npxcommand. - Sanitization: No explicit sanitization or filtering logic is described for the data ingested from Jotform.
Audit Metadata