sandbox-self-test
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
run_suite.pyscript utilizessubprocess.runto execute local scripts within the repository'sskills/directory. This is a core component of the test suite's functionality for verifying the toolkit. - [EXTERNAL_DOWNLOADS]: The skill communicates with the HubSpot API at
api.hubapi.comto perform CRM data operations and validate account metadata. This is a legitimate use of the official service for this skill's purpose. - [DATA_EXFILTRATION]: The skill manages a dedicated environment variable,
HUBSPOT_SANDBOX_ACCESS_TOKEN. It implements mandatory account-type validation in every script to prevent accidental execution against production portals. - [PROMPT_INJECTION]: The skill processes data retrieved from the HubSpot API.
- Ingestion points: Responses from various HubSpot CRM and Automation endpoints are ingested by
preflight.py,seed.py,run_suite.py, andteardown.py. - Boundary markers: No explicit delimiters are used in the script-level data processing.
- Capability inventory: Includes
subprocess.runcapabilities and full CRUD access to HubSpot CRM objects (contacts, companies, lists) and automation workflows. - Sanitization: Data from the API is used for internal logic and reporting without specific sanitization filters.
Audit Metadata