greenfield-pearl-tracker-skill
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script,
scripts/build_workbook.py, to process data and generate Excel workbooks. This is an expected functional behavior for its report generation purpose. - [DATA_EXFILTRATION]: The skill facilitates the transfer of summarized report data to well-known business platforms, including sending Slack notifications to specific users and creating notes or tasks within HubSpot. These operations utilize established services and are consistent with the skill's stated business objectives.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from CRM records (HubSpot) and call summaries (Clari). It addresses the risk of malicious instructions in these data sources by implementing a
safe()function in the workbook generation script that sanitizes strings starting with potential formula triggers (such as=,+, and-), effectively mitigating spreadsheet injection attacks at the output layer.
Audit Metadata