activecampaign
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external CRM data (contacts, leads, activities, etc.) which acts as an ingestion surface for potentially untrusted content.
- Ingestion points: CRM data retrieved via the Apideck unified API as described in SKILL.md.
- Boundary markers: The instructions do not specify explicit delimiters or guardrails for the processed data.
- Capability inventory: The skill can read, write, and search CRM data, and perform network operations via the Apideck SDK and Proxy API (SKILL.md).
- Sanitization: There is no mention of sanitizing or filtering the retrieved data before it is used by the agent.
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
@apideck/unifyNode.js package and references configuration files from the vendor's official domain (unify.apideck.com). - [COMMAND_EXECUTION]: Provides example curl commands for developers to interact with the Apideck API for coverage verification and proxy requests.
Audit Metadata