Gong Automation

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted content from Gong call transcripts and conversation analytics, which introduces a potential surface for indirect prompt injection attacks.
  • Ingestion points: Data is retrieved via several tools described in SKILL.md, such as GONG_RETRIEVE_TRANSCRIPTS_OF_CALLS_V2_CALLS_TRANSCRIPT and GONG_GET_CALL_TRANSCRIPT.
  • Boundary markers: The instructions do not define any specific delimiters or safety prompts to prevent the agent from following instructions that might be embedded within the transcripts.
  • Capability inventory: The skill is scoped to data retrieval through the Gong API; it does not include high-privilege capabilities such as arbitrary shell command execution or local file writing.
  • Sanitization: No explicit content filtering or sanitization measures are mentioned to handle potentially malicious input within the call data.
  • [EXTERNAL_DOWNLOADS]: The skill requires connection to an external Model Context Protocol (MCP) server at https://rube.app/mcp to provide its automation tools.
  • The setup instructions direct the user to add this external configuration to their client to enable the Gong integration.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 02:15 AM