skills/jeremylongshore/tons-of-skills-marketplace/hubspot-deal-pipeline-automation/Gen Agent Trust Hub
hubspot-deal-pipeline-automation
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from external HubSpot API endpoints (deals, properties, associations), which constitutes a surface for indirect prompt injection if the source data is compromised.
- Ingestion points: Data is fetched from HubSpot CRM Search and Objects APIs in
SKILL.mdandreferences/implementation-guide.md(viaurllib.request). - Boundary markers: Absent; there are no specific delimiters or instructions to ignore embedded content within the ingested API data.
- Capability inventory: The skill uses
Bash(curl),Bash(python3), and theWritetool to interact with the environment and remote APIs. - Sanitization: No explicit sanitization or filtering of external content is implemented in the provided scripts.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch deal and pipeline information from HubSpot's official API (
api.hubapi.com), a well-known service provider. - [COMMAND_EXECUTION]: Utilizes system utilities including
curlfor API requests andjqfor JSON processing within shell environments described inSKILL.md. - [DYNAMIC_EXECUTION]: Uses
python3 -cfor inline execution of Python code to perform date calculations and generate epoch timestamps for API query filters.
Audit Metadata