zapier-israeli-integrations
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, such as payment gateway webhooks (Cardcom, Grow by Meshulam) and form submissions (Typeform, Elementor), which are then used in downstream actions including document creation and customer communications.
- Ingestion points: Webhook JSON payloads from third-party payment processors and form providers referenced in SKILL.md and references/zap-templates.md.
- Boundary markers: The instructions lack specific guidance on using delimiters or guardrails when interpolating external fields into email or document templates.
- Capability inventory: The skill utilizes Webhooks by Zapier for Custom API Requests, as well as Gmail, WhatsApp Business, and Monday.com actions, which provide significant interaction capabilities with external systems.
- Sanitization: The skill includes specific Code by Zapier snippets designed to sanitize Hebrew input by stripping Unicode directional markers and zero-width characters (U+200F, U+200E, U+200B, etc.), which provides a basic level of input cleaning.
Audit Metadata