0xinsider-api-access
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill manages authentication via environment variables (
$OXINSIDER_API_KEY) and OAuth 2.1 with PKCE, explicitly advising against hardcoding credentials. - [SAFE]: All network operations and API endpoints target official vendor domains, specifically
0xinsider.comandapi.0xinsider.com. - [SAFE]: External dependencies and installation commands refer to the official
0xinsiderpackage on the NPM registry and the vendor's Homebrew tap. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external API data from
api.0xinsider.cominto the agent's context. - Ingestion points: API response data from endpoints such as
/leaderboard,/platforms, and/usage(documented inSKILL.md). - Boundary markers: The instructions do not define specific delimiters or instructions for the agent to treat API data as untrusted content.
- Capability inventory: The skill uses
curlfor data retrieval and interacts with a remote MCP server athttps://0xinsider.com/mcp. - Sanitization: The skill recommends branching based on structured JSON
error.codevalues but does not describe content sanitization for data interpolation.
Audit Metadata