zoho
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and execute the@useclawlink/clipackage from the NPM registry, which is a standard and well-known service.- [COMMAND_EXECUTION]: Instructions are provided to run CLI commands throughnpxfor logging in, connecting to Zoho, and performing actions. These are legitimate operations for the skill's stated purpose.- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface where user-supplied strings or data retrieved from Zoho could be processed by the agent to determine actions. - Ingestion points: User input passed to
npx @useclawlink/cli actionsand action inputs inSKILL.md. - Boundary markers: Not present in the command examples.
- Capability inventory: The skill has the ability to execute shell commands via
npxand perform network operations through the CLI tool. - Sanitization: Not explicitly defined in the instructions; the skill relies on the underlying CLI tool and agent safety layers.
Audit Metadata