hubspot-automation
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to configure a remote MCP server at
https://rube.app/mcp. This connects the agent to a third-party execution environment that mediates access between the agent and the HubSpot CRM. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from HubSpot CRM, which is a significant surface for indirect injection attacks.
- Ingestion points: Data enters the agent's context through tools like
HUBSPOT_SEARCH_CONTACTS_BY_CRITERIA,HUBSPOT_GET_COMPANY,HUBSPOT_SEARCH_TICKETS, andHUBSPOT_RETRIEVE_OWNERS(found inSKILL.md). - Boundary markers: Absent. The instructions do not provide delimiters or specific guidance to the agent to ignore potentially malicious instructions embedded in contact fields, ticket descriptions, or deal notes.
- Capability inventory: The skill possesses extensive write capabilities, including creating/updating contacts, companies, deals, and custom properties (e.g.,
HUBSPOT_CREATE_CONTACT,HUBSPOT_CREATE_COMPANIES,HUBSPOT_CREATE_PROPERTY_FOR_SPECIFIED_OBJECT_TYPE), which could be abused if the agent follows instructions hidden in processed data. - Sanitization: Absent. There are no instructions for the agent to validate or sanitize external content before interpolation or action.
Audit Metadata