integrate-hookmyapp
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates the installation of the
@gethookmyapp/clipackage and executes various subcommands for managing Meta messaging channels, workspaces, and support tickets. - [EXTERNAL_DOWNLOADS]: Fetches the official HookMyApp CLI from the npm registry and a webhook starter kit from the vendor's public GitHub repository.
- [PERSISTENCE]: The skill instructs the agent to modify the user's shell configuration files (e.g.,
.zshrc,.bash_profile, or.profile) to ensure the CLI's installation path is persisted across terminal sessions. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted inbound webhook data from external platforms (WhatsApp, Instagram, and Facebook Messenger).
- Ingestion points: Inbound message and comment data from Meta webhooks (described in SKILL.md and references/webhook.md).
- Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are provided for the raw Meta webhook payloads.
- Capability inventory: The skill possesses capabilities for sending messages, publishing content, and executing CLI commands.
- Sanitization: No specific sanitization or escaping logic is included for the content of the inbound message bodies.
Audit Metadata