clay
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates legitimate interaction with Clay's table API (
api.clay.com/v3). All tool operations (create, update, find, list) are consistent with the stated purpose of the connector. - [COMMAND_EXECUTION]: The entry point
cli.jsusesspawnSyncto execute the connector logic. This is an architectural choice used to perform runtime readiness checks and support multiple JavaScript environments (Node.js and Bun), which is standard for this connector SDK. - [CREDENTIALS_UNSAFE]: Authentication is handled via a single Clay API key. The skill follows security best practices by providing documentation and mechanisms to load this key from environment variables (
env:CLAY_API_KEY) or through a managed authentication service, avoiding the need to expose secrets in script arguments or chat history. - [EXTERNAL_DOWNLOADS]: The skill communicates exclusively with official Clay API endpoints. There are no patterns of downloading or executing remote code from untrusted sources.
- [PROMPT_INJECTION]: The
SKILL.mdinstructions include safety guidance for the agent, such as requiring match confirmation before updating records and explicitly refusing unsupported operations like row deletion, which helps maintain system integrity.
Audit Metadata