cross-crm-opportunity-sync
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscated code, or unauthorized network operations were detected. The skill is authored by Zapier and utilizes official vendor-owned domains (mcp.zapier.com) and SDKs for its execution environment.
- [DATA_EXFILTRATION]: The skill performs data synchronization between CRM systems via the Zapier MCP server. This activity is restricted to approved fields and specifically excludes raw text notes, revenue fields, and commission-sensitive data from automated processing without human intervention.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes external CRM record data for matching and enrichment.
- Ingestion points: CRM opportunity, account, and customer records sourced from connected CRM platforms as defined in SKILL.md and SCHEMA-MAP.md.
- Boundary markers: The skill relies on structured schema mapping and canonical taxonomies to define data boundaries, rather than allowing arbitrary text processing.
- Capability inventory: The skill utilizes CRM read/write actions, LLM-based enrichment, and team notification tools via the Zapier MCP and SDK.
- Sanitization: Robust sanitization is provided through mandatory sandbox testing, audit logging for every write operation, and a requirement for manual approval of low-confidence matches and revenue-sensitive updates.
Audit Metadata