pandadoc
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch the@useclawlink/clipackage from the npm registry. - [REMOTE_CODE_EXECUTION]: The skill executes the
@useclawlink/clipackage to perform PandaDoc operations. - [COMMAND_EXECUTION]: Relies on shell commands for setup (
npx @useclawlink/cli login) and task execution (npx @useclawlink/cli run). - [PROMPT_INJECTION]: The skill processes user-supplied strings and JSON objects to execute actions.
- Ingestion points: User-provided input for action descriptions and JSON payloads in
SKILL.md. - Boundary markers: Not present in the command templates, though user confirmation is advised.
- Capability inventory: Performs PandaDoc API interactions through
npxsubprocess calls. - Sanitization: The skill instructions do not specify input validation or sanitization.
Audit Metadata