agently-request

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill is a set of comprehensive documentation and code examples for the Agently framework. It describes standard AI agent functionalities such as model request configuration, streaming, audio processing (TTS/STT), and knowledge retrieval.
  • [CREDENTIALS_UNSAFE]: The skill follows secure coding practices regarding secrets. Examples demonstrate retrieving API keys and base URLs from environment variables (e.g., os.getenv('AUDIO_API_KEY'), ${ENV.DEMO_API_KEY}) rather than hardcoding sensitive information. It also explicitly advises redacting secrets before retaining prompt evidence in logs.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides defensive guidance against indirect prompt injection. It instructs developers to use Agently's prompt slots (input, info, instruct, output) to create structural boundaries between untrusted data and instructions. It further recommends using deterministic validation (Pydantic models and lambda validators) to enforce safety rules on model output.
  • [COMMAND_EXECUTION]: While the skill mentions model-generated calculation plans and tool usage, it correctly identifies these as capabilities that should be managed by host code and deterministic tools. It does not contain any unsafe subprocess or os.system calls using unvalidated data.
  • [DATA_EXFILTRATION]: No evidence of malicious data exfiltration was found. Data retrieval and storage patterns described (e.g., using RecordStore with SQLite or Chroma) are local and consistent with the documented purpose of knowledge retrieval and session memory.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 03:18 AM
Security Audit — agent-trust-hub — agently-request