vibe-coding-api-connect
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides boilerplate code for API integrations following industry best practices.
- [CREDENTIALS_SAFE]: It explicitly instructs users to store secrets like API keys and webhook secrets in
.env.localfiles and includes a rule to never prefix them withNEXT_PUBLIC_(which prevents accidental exposure to the client-side). It correctly uses placeholders like[SERVICE]_API_KEYrather than hardcoding credentials. - [COMMAND_EXECUTION]: While it mentions
pip install, these are standard development instructions for common libraries (httpx,requests,authlib) and do not involve untrusted remote execution. - [INDIRECT_PROMPT_INJECTION]: The skill generates code based on user inputs (API names), but does not execute this data in a way that creates an injection risk for the agent itself. It includes standard verification logic (HMAC) for webhook handlers.
- [EXTERNAL_DOWNLOADS]: Mentions of standard package registries (PyPI via
pip) for well-known libraries are considered safe development practices.
Audit Metadata