Skills
Navigate
skills/agentworkforce/skills/setting-up-agent-relay-flows/Gen Agent Trust Hub

setting-up-agent-relay-flows

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the agent-relay CLI via npx --yes agent-relay@13 to connect model provider credentials. This is a standard vendor-provided utility necessary for the skill's purpose.\n- [EXTERNAL_DOWNLOADS]: Fetches configuration metadata and flow source code from agentrelay.com. It also retrieves the agent-relay package from the official npm registry via the npx command.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the flow catalog and remote TypeScript source files to configure and deploy listeners.\n
  • Ingestion points: External API responses from https://agentrelay.com/api/v1/flows/catalog and remote files at source.rawUrl.\n
  • Boundary markers: The skill includes explicit instructions to verify downloaded source code against a provided SHA256 hash.\n
  • Capability inventory: Uses npx for credential management and POST /api/v1/flows/deploy for network-based code deployment.\n
  • Sanitization: Employs integrity verification (SHA256) of external source text before it is used for deployment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 12:10 AM