API Tester
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating an indirect prompt injection vulnerability surface. 1. Ingestion points: The agent reads external API responses, third-party service documentation, and API specifications (SKILL.md, Workflow Step 1). 2. Boundary markers: The instructions do not define delimiters or specific 'ignore' directives to separate external data from agent instructions. 3. Capability inventory: The skill uses network tools (demonstrated by fetch in the technical deliverables) and generates detailed reports based on untrusted inputs. 4. Sanitization: There is no mention of sanitizing or escaping content from external APIs before it is interpolated into reports or used for decision-making.
Audit Metadata