rocketreach
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
npx @useclawlink/clitool to interact with RocketReach. - [EXTERNAL_DOWNLOADS]: The skill utilizes the NPM package manager (
npx) to fetch and execute the@useclawlink/clipackage from the public registry. This package is the official tool provided by the vendor. - [PROMPT_INJECTION]: The skill ingests untrusted data from the RocketReach API (people and company profiles) into the agent context, creating a surface for indirect prompt injection. Ingestion points: Data returned from person/company lookups and searches in SKILL.md. Boundary markers: None explicitly specified for tool output. Capability inventory: Subprocess execution via
npx(SKILL.md). Sanitization: No explicit sanitization or escaping described for the interpolated API data.
Audit Metadata