zoho-inventory
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the npx utility to fetch the @useclawlink/cli package from the official npm registry, which is a standard method for running Node.js CLI tools.
- [COMMAND_EXECUTION]: The skill uses shell commands to interact with the ClawLink CLI for logging in, connecting to Zoho Inventory, and running specific inventory actions.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts natural language strings as input for action discovery, which constitutes a potential surface for indirect prompt injection.
- Ingestion points: The search query parameter in the 'npx @useclawlink/cli actions zoho-inventory' command.
- Boundary markers: Not present in the provided instructions.
- Capability inventory: Execution of shell commands via npx and ClawLink CLI.
- Sanitization: The skill instructions do not specify input validation or sanitization for the search query.
Audit Metadata