new-contact-hygiene-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
uv runto execute internal Python scripts (before.py,execute.py,after.py) to manage HubSpot workflows. These operations are transparent, limited to the skill's defined scope, and do not involve arbitrary command injection or privilege escalation. - [EXTERNAL_DOWNLOADS]: The skill makes authenticated requests to
api.hubapi.com. HubSpot is a well-known service, and this communication is essential for the skill's primary function. No code or data is fetched from untrusted or unknown third-party sources. - [CREDENTIALS_UNSAFE]: Authentication is managed via a
HUBSPOT_ACCESS_TOKENretrieved from a.envfile. The skill correctly follows standard secret management best practices by instructing users to use environmental variables rather than hardcoding credentials. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves workflow metadata from the HubSpot API for inventory and verification purposes. It does not interpolate this external data into agent prompts, effectively mitigating the risk of indirect prompt injection attacks.
Audit Metadata