inbound-lead-qualification

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python scripts to perform various tasks such as CRM lookups, web research, and scorecard building. These scripts are self-contained and perform legitimate operations like reading CSV files and making standard HTTP requests.
  • [EXTERNAL_DOWNLOADS]: The scripts/web_research.py script performs web searches using DuckDuckGo and fetches page content for research purposes. This is a primary function of the skill and uses standard library functions without suspicious execution patterns.
  • [CREDENTIALS_UNSAFE]: The skill correctly handles credentials by referencing environment variables (HUBSPOT_API_KEY, APOLLO_API_KEY, ANTHROPIC_API_KEY) instead of hardcoding sensitive information. It also provides a fallback mechanism using CSV files if API keys are not provided.
  • [DATA_EXFILTRATION]: Network operations are restricted to searching DuckDuckGo and accessing the HubSpot CRM API (if configured). There are no patterns suggesting the unauthorized exfiltration of sensitive local data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 05:28 AM
Security Audit — agent-trust-hub — inbound-lead-qualification