hubspot-create-company
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION] (LOW): Indirect prompt injection vulnerability surface detected. Ingestion points: User-provided company metadata such as name, domain, industry, and city passed as CLI arguments. Boundary markers: None; parameters are directly interpolated into shell commands. Capability inventory: Subprocess execution of local python scripts (create_company.py and check_hubspot_config.py). Sanitization: No explicit sanitization or escaping of shell arguments is documented in the skill description.
- [COMMAND_EXECUTION] (SAFE): The skill executes local Python scripts located in the 00-system path for its intended CRM operations. No unauthorized or suspicious command patterns like sudo, chmod, or piping to shells were identified.
Audit Metadata