sendgrid
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes actions using the
@useclawlink/clitool vianpx. These commands are standard for interacting with the vendor's API gateway and managing SendGrid resources. - [DATA_EXPOSURE]: The skill stores its own authentication credentials in
~/.clawlink/credentials.json. This is a standard practice for CLI tools to maintain session state and does not involve accessing sensitive system files like SSH keys or AWS credentials. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates reading data from SendGrid, such as contact details and campaign information. While this creates a potential surface for indirect prompt injection if the source data contains malicious instructions, the skill includes explicit instructions for the agent to read first and confirm with the user before performing any write operations.
- [SAFE]: All external resources, including the NPM package and documentation URLs, originate from the official vendor infrastructure associated with ClawLink.
Audit Metadata