activecampaign-automation
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the user to add an external MCP server at
https://rube.app/mcpto their configuration. This introduces a runtime dependency on a non-standard third-party service to provide the skill's core functionality. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from ActiveCampaign that could contain malicious instructions.
- Ingestion points: Contact data, tags, and notes retrieved via
ACTIVE_CAMPAIGN_FIND_CONTACT. - Boundary markers: None present; there are no instructions for the agent to ignore or delimit embedded commands in contact fields.
- Capability inventory: The skill can create contacts, manage subscriptions, and generate tasks using tool
ACTIVE_CAMPAIGN_CREATE_CONTACT_TASK. - Sanitization: No validation or escaping is specified for data interpolated into task titles or notes.
Audit Metadata