crm-connect
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructs the agent to process data from external CRM systems and web-based API documentation, which introduces a surface for indirect prompt injection.
- Ingestion points: The agent ingests untrusted data from CRM API responses (e.g., contact notes, task descriptions, deal history) and external documentation retrieved via web search in file
SKILL.md(Gate G1 and 패턴). - Boundary markers: There are no instructions for the agent to use delimiters or specific safety prompts to ignore potential instructions embedded within the CRM data or documentation.
- Capability inventory: The agent is empowered to execute shell commands (
curl), perform network operations, and write to the local file system (CRM.mdconnection card). - Sanitization: The instructions suggest using
json.dumps()for outgoing payloads to ensure data integrity, but there is no mention of sanitizing or validating the content received from external sources before it is processed by the agent. - [COMMAND_EXECUTION]: The skill explicitly directs the agent to use shell commands, such as
curl, to interact with external CRM APIs as defined in the hard rules and operational patterns sections. While this is the intended functionality of the skill, it represents an exploitable capability if the agent's context is manipulated via prompt injection.
Audit Metadata