enrich-company-name
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The audit scripts (
before.pyandafter.py) perform network requests to the official HubSpot API endpoint (api.hubapi.com). This communication is limited to the well-known service and serves the skill's primary purpose of CRM data auditing. - [COMMAND_EXECUTION]: The skill instructions direct the user to run local Python scripts using the
uvtool. These scripts execute queries against the HubSpot API and log state information to local CSV files. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves contact properties (email, names) from HubSpot's API, creating a data ingestion surface.
- Ingestion points: Data is fetched via the CRM Search and Association APIs in the
before.pyandafter.pyscripts. - Boundary markers: None identified for the logged audit data.
- Capability inventory: The scripts perform file writing to local audit logs (
data/audit-logs/) and network requests to HubSpot. - Sanitization: The scripts do not explicitly sanitize the external data before logging it. However, because this data is used for local reporting and not for dynamic prompt generation or command injection, the associated risk is negligible.
Audit Metadata