webhook-http-request
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill facilitates indirect prompt injection by processing responses from arbitrary external URLs into the agent's context.
- Ingestion points: The
requestaction inSKILL.mdfetches content from user-provided URLs. - Boundary markers: The instructions do not specify any delimiters or warnings for the agent to ignore potential instructions embedded within the fetched HTTP response data.
- Capability inventory: The skill supports various HTTP methods (GET, POST, PUT, DELETE, etc.) which can be used to read from or write to external services.
- Sanitization: No explicit sanitization or filtering of the external response body is described before it is returned to the agent.
- [EXTERNAL_DOWNLOADS]: The documentation includes instructions to download and install prerequisite setup skills from the vendor's own repository.
- Evidence:
SKILL.mdreferences installation vianpx skills add AgentPMT/agent-skills --skill what-is-agentpmtandnpx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup.
Audit Metadata