gong
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses a local file at
~/.config/gong/credentials.jsonto retrieve Gong API credentials (access_key,secret_key, andbase_url). This is the primary mechanism for authenticating requests to the Gong service. - [PROMPT_INJECTION]: The skill retrieves call transcripts and meeting content, which represents untrusted external data.
- Ingestion points: The
transcriptandcallcommands inscripts/gong.shfetch raw text from the Gong API. - Boundary markers: There are no markers or instructions provided to the agent to distinguish between the fetched transcript text and system instructions.
- Capability inventory: The script uses
curlfor network requests andjqfor parsing JSON data. - Sanitization: The skill does not perform sanitization or filtering on the retrieved transcript content before it is presented to the agent.
Audit Metadata