hubspot
Warn
Audited by Snyk on Mar 26, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly fetches data from HubSpot's public API (e.g., curl requests to https://api.hubapi.com in "Get Contact", "List Tickets", "List Contacts") which can contain untrusted/user-generated fields (ticket content, contact properties) that the agent is expected to read and that could materially influence subsequent actions.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata