visitor-identification
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
hubspotCLI tool for generating visitor identification tokens. These commands are standard for the HubSpot platform and are used to interact with their official API. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as email addresses and names which could potentially contain malicious instructions if the data source is untrusted.
- Ingestion points: The command line arguments
--email,--first-name, and--last-nameinSKILL.mdare used to interpolate user-provided data into shell commands. - Boundary markers: The skill does not define specific boundary markers or delimiters for these inputs.
- Capability inventory: The agent is instructed to execute the
hubspotCLI tool using these inputs. - Sanitization: The instructions do not specify any input sanitization or validation before passing data to the CLI command.
Audit Metadata