salesflare
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the CRM OpenAPI specification and connector metadata from Apideck's official servers (specs.apideck.com and unify.apideck.com) to provide the agent with technical details for the integration.
- [INDIRECT_PROMPT_INJECTION]: This skill allows the agent to read and search external CRM data (contacts, leads, companies), creating a potential surface for indirect prompt injection if that data contains malicious instructions meant to hijack the agent's context.
- Ingestion points: External CRM data retrieved through the Apideck CRM unified API.
- Boundary markers: The skill does not provide specific instructions or delimiters to the agent to treat ingested CRM data as potentially unsafe or distinct from its core instructions.
- Capability inventory: The skill allows for reading, searching, and writing data to external CRM systems via the @apideck/unify library and Apideck REST API.
- Sanitization: There is no evidence of sanitization or validation of external data fields within the provided instructions or code examples.
Audit Metadata