inbound-lead-qualification
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to perform various tasks such as CRM lookups, web research, and scorecard building. These scripts are self-contained and perform legitimate operations like reading CSV files and making standard HTTP requests.
- [EXTERNAL_DOWNLOADS]: The
scripts/web_research.pyscript performs web searches using DuckDuckGo and fetches page content for research purposes. This is a primary function of the skill and uses standard library functions without suspicious execution patterns. - [CREDENTIALS_UNSAFE]: The skill correctly handles credentials by referencing environment variables (
HUBSPOT_API_KEY,APOLLO_API_KEY,ANTHROPIC_API_KEY) instead of hardcoding sensitive information. It also provides a fallback mechanism using CSV files if API keys are not provided. - [DATA_EXFILTRATION]: Network operations are restricted to searching DuckDuckGo and accessing the HubSpot CRM API (if configured). There are no patterns suggesting the unauthorized exfiltration of sensitive local data.
Audit Metadata