typeform
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
@useclawlink/clipackage from the official NPM registry vianpxcommands to provide its core functionality. - [COMMAND_EXECUTION]: The skill requires the execution of shell commands to authenticate the user and perform actions on the Typeform account.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Typeform forms and user responses, which creates a potential surface for indirect prompt injection.
- Ingestion points: Data retrieved via actions such as
typeform_get_form_responsesandtypeform_get_form. - Boundary markers: The instructions do not specify any delimiters or safety warnings to ignore instructions embedded within the form data.
- Capability inventory: The skill has the ability to write to the file system (creating credentials), modify Typeform account configurations, and manage webhooks.
- Sanitization: No explicit sanitization or filtering logic is provided in the skill instructions for external data.
Audit Metadata