reassign-deactivated-owners
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill performs legitimate CRM maintenance tasks using official HubSpot APIs to manage object ownership.
- [CREDENTIALS_UNSAFE]: Secret management follows best practices by using environment variables (.env file) rather than hardcoded tokens for the
HUBSPOT_ACCESS_TOKEN. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from HubSpot APIs, which represents an ingestion surface for untrusted external data.
- Ingestion points: HubSpot API responses containing owner names, emails, and object counts in
scripts/before.py,scripts/execute.py, andscripts/after.py. - Boundary markers: Not present.
- Capability inventory: File-writing to the
data/audit-logs/directory and network-write capabilities via the HubSpot Batch Update API. - Sanitization: Relies on standard JSON parsing from the
requestslibrary. - [EXTERNAL_DOWNLOADS]: Dependencies are limited to well-known, standard libraries (
requests,python-dotenv) managed through theuvpackage manager, which is a reputable tool.
Audit Metadata