skills/clawlink-hq/skills/postmark/Gen Agent Trust Hub

postmark

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using npx @useclawlink/cli for authentication and Postmark operations.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx to fetch the @useclawlink/cli package from the NPM registry. This is a standard distribution method for the tool provided by the skill author.
  • [INDIRECT_PROMPT_INJECTION]: The skill features a data ingestion surface by reading external data from Postmark (e.g., email delivery statistics and bounce logs).
  • Ingestion points: API responses from actions like postmark_get_bounces and postmark_get_delivery_stats defined in SKILL.md.
  • Boundary markers: None specified in the prompt instructions to delimit external data from agent commands.
  • Capability inventory: The skill has the capability to execute shell commands via the ClawLink CLI.
  • Sanitization: No sanitization of the retrieved external content is described in the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 05:45 PM