loyalty-points-integration
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is primarily instructional and provides high-quality guidance on building secure API endpoints. It explicitly warns against insecure practices like committing secrets to source control or using non-constant-time string comparisons for authentication tokens.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions involve the agent interacting with a developer's codebase to implement API logic, which is an inherent part of its purpose.
- Ingestion points: The agent is guided to read developer queries and project files to implement the defined loyalty endpoints (SKILL.md).
- Boundary markers: While no specific delimiters are enforced for untrusted code, the skill provides a strict OpenAPI contract and canonical signing specification to govern how the agent handles data.
- Capability inventory: The agent generates implementation logic and architectural recipes but does not possess tools for unauthorized network or file operations beyond assisting the developer (SKILL.md).
- Sanitization: The instructions prioritize resolving member data and points from stored hold records rather than external request parameters, providing a natural defense against manipulated input during redemptions.
Audit Metadata