timely
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto fetch and execute the@useclawlink/clipackage from the NPM registry. This is a standard method for utilizing the vendor's official command-line interface. - [COMMAND_EXECUTION]: The instructions guide the agent to perform actions such as
login,connect, andrunusing the shell environment. These commands are necessary for the skill's stated productivity purpose. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes natural language input and external data from Timely through the
actionsandruncommands. - Ingestion points: User-provided strings passed as arguments to the CLI in
SKILL.mdand data retrieved from Timely actions. - Boundary markers: None identified in the provided instructions.
- Capability inventory: Execution of shell commands via
npxis present inSKILL.md. - Sanitization: No explicit sanitization or filtering of external data is described in the skill instructions.
Audit Metadata