0xinsider-api-access

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill manages authentication via environment variables ($OXINSIDER_API_KEY) and OAuth 2.1 with PKCE, explicitly advising against hardcoding credentials.
  • [SAFE]: All network operations and API endpoints target official vendor domains, specifically 0xinsider.com and api.0xinsider.com.
  • [SAFE]: External dependencies and installation commands refer to the official 0xinsider package on the NPM registry and the vendor's Homebrew tap.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external API data from api.0xinsider.com into the agent's context.
  • Ingestion points: API response data from endpoints such as /leaderboard, /platforms, and /usage (documented in SKILL.md).
  • Boundary markers: The instructions do not define specific delimiters or instructions for the agent to treat API data as untrusted content.
  • Capability inventory: The skill uses curl for data retrieval and interacts with a remote MCP server at https://0xinsider.com/mcp.
  • Sanitization: The skill recommends branching based on structured JSON error.code values but does not describe content sanitization for data interpolation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 08:31 PM