crm-cleanup
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill processes external data from HubSpot records which could potentially contain instructions that influence the agent's behavior.
- Ingestion Points: The skill pulls deals and contacts from the HubSpot API in Steps 1, 2, and 3 (
SKILL.md). - Boundary Markers: The skill lacks explicit prompt delimiters or "ignore embedded instructions" warnings for external data, but it enforces procedural boundaries by requiring side-by-side diffs and manual approvals for all changes.
- Capability Inventory: The skill is configured with
Bash,WebFetch, andReadtools, providing the ability to execute system commands and perform network operations (SKILL.md). - Sanitization: There are no explicit instructions to sanitize or escape data retrieved from HubSpot before processing. The primary mitigation is the requirement for the owner to explicitly approve every change after reviewing the proposed updates.
- Direct Instruction Override: The instructions include a directive to "Act immediately" and "skip the intent-detection step" when the command is triggered. While this is likely intended to improve user experience for a specific command, it represents an instruction to bypass a processing layer that may be part of the host system's standard interaction workflow.
Audit Metadata