nooks-call-wrap

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes platform-specific tools for CRM management, such as createTask in Nooks and hubspot_create_contact_note in HubSpot. These operations are strictly scoped to the running user's own records, verified via the getMe tool, and prohibit destructive actions like deleteTask or skipTask.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external call notes (either pasted by the user or retrieved via Clari/Nooks APIs) to generate MEDDIC scores and follow-up drafts.
  • Ingestion points: The SKILL.md file defines inputs including pasted call notes and data retrieved via clari_get_call and getCall tools.
  • Boundary markers: While the skill does not define specific prompt delimiters for the notes, it provides a structured context using tags like <meddic_scoring> and <workflow>.
  • Capability inventory: The skill has the ability to write to CRM systems (createTask, hubspot_create_contact_note) and propose calendar times (suggest_time).
  • Sanitization: The skill implements a 'human-in-the-loop' model where the AI drafts content but never auto-sends emails, and HubSpot writes are restricted to specific authorized users (Tim or Victor).
  • [SAFE]: The skill implements several 'Gates' to maintain output quality and safety: Gate B verifies technical product specs live via search tools; Gate C enforces brand voice through persona tools; and Gate D restricts operations to USA/Canada accounts, stopping execution if a Rest-of-World account is detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:54 PM