he-dial-queue-skill
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted contact data from HubSpot that is subsequently used in automated workflows.
- Ingestion points: Contact fields such as
firstname,lastname, andjobtitleare retrieved via thesearch_crm_objectstool in Stage 1 ofSKILL.md. - Boundary markers: The instructions lack specific guidance for the agent to treat interpolated data as untrusted or to use defensive delimiters to isolate external content.
- Capability inventory: The agent has the ability to write to Google Drive (
mcp__claude_ai_Google_Drive__create_file), send notifications (slack_send_message), and perform batch updates to CRM records (manage_crm_objects). - Sanitization: While Stage 5 mentions escaping for CSV format, there is no semantic validation or filtering to prevent instructions embedded in CRM fields from influencing agent behavior.
- [SAFE]: The skill includes hardcoded HubSpot Portal and Owner IDs (e.g., Portal
21530819). These are internal environment identifiers necessary for the skill's specific functionality and do not represent a credential exposure risk.
Audit Metadata