close-automation
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires users to add an external MCP server endpoint (https://rube.app/mcp) to their configuration to access the necessary CRM tools.
- [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection due to its interaction with data from Close CRM.
- Ingestion points: The agent ingests data from external sources via tools like CLOSE_GET_NOTE and lead search results.
- Boundary markers: The skill lacks explicit instructions or delimiters to prevent the agent from treating data within CRM records as system instructions.
- Capability inventory: The agent has write access to the CRM, including sending SMS messages (CLOSE_CREATE_SMS), deleting activity logs (CLOSE_DELETE_CALL), and modifying lead information.
- Sanitization: No mechanisms for sanitizing or validating the content retrieved from the CRM are mentioned in the skill definition.
Audit Metadata