clay-prod-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Bash script designed to verify the health of webhooks and API endpoints using
curlas part of a pre-flight checklist. - [EXTERNAL_DOWNLOADS]: The skill interacts with
api.clay.comand references documentation atuniversity.clay.com. These are official resources for Clay, a well-known SaaS provider, and are considered safe. - [INDIRECT_PROMPT_INJECTION]: The skill defines a validation function for processing lead data rows. While this constitutes an ingestion surface, the logic is limited to data validation and does not interpolate untrusted content into agent instructions.
- Ingestion points:
validateForProduction(rows)function inSKILL.md. - Boundary markers: Absent.
- Capability inventory:
Bash(curl:*)tool access for connectivity testing. - Sanitization: Includes explicit checks for personal email domains and duplicate records before processing.
Audit Metadata