integrate
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of several external dependencies from public package registries.
- Instructions include
npm install @olakai/sdkandnpm install -g olakai-cli. - Instructions include
pip install olakai-sdkfor Python environments. - [DATA_EXFILTRATION]: The skill's primary function is to transmit agent interaction data to an external service (
olakai.ai). While this is the intended purpose of the monitoring integration, it involves sending sensitive content including user prompts, LLM responses, and user metadata (e.g.,userEmail). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which creates a surface for indirect prompt injection via the monitoring pipeline.
- Ingestion points: The skill ingests raw
userMessageandresponse.choices[0].message.content(found inSKILL.md). - Boundary markers: There are no delimiters or boundary markers used when passing this data to the
olakai()tracking function. - Capability inventory: The skill uses the SDK to transmit captured data to the external
olakai.aidomain. - Sanitization: The provided examples do not include sanitization or filtering of prompts or responses before they are transmitted to the external service.
Audit Metadata