crm-sync
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill documentation describes a standard data integration workflow without any malicious obfuscation, credential harvesting, or unauthorized remote code execution. The presence of 'disable-model-invocation: true' serves as a significant safety boundary.- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external campaign feedback and contact records, which is a potential surface for indirect injection. 1. Ingestion points: 'Campaign data' and 'Contact records' inputs defined in SKILL.md. 2. Boundary markers: Not explicitly defined in the workflow instructions. 3. Capability inventory: Writing metrics and contact data to HubSpot/Salesforce APIs. 4. Sanitization: The workflow includes a 'Validate Data' step to check for required fields and perform deduplication before syncing.
Audit Metadata