skills/clawlink-hq/skills/timely/Gen Agent Trust Hub

timely

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx to fetch and execute the @useclawlink/cli package from the NPM registry. This is a standard method for utilizing the vendor's official command-line interface.
  • [COMMAND_EXECUTION]: The instructions guide the agent to perform actions such as login, connect, and run using the shell environment. These commands are necessary for the skill's stated productivity purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes natural language input and external data from Timely through the actions and run commands.
  • Ingestion points: User-provided strings passed as arguments to the CLI in SKILL.md and data retrieved from Timely actions.
  • Boundary markers: None identified in the provided instructions.
  • Capability inventory: Execution of shell commands via npx is present in SKILL.md.
  • Sanitization: No explicit sanitization or filtering of external data is described in the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 05:45 PM