integrate

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of several external dependencies from public package registries.
  • Instructions include npm install @olakai/sdk and npm install -g olakai-cli.
  • Instructions include pip install olakai-sdk for Python environments.
  • [DATA_EXFILTRATION]: The skill's primary function is to transmit agent interaction data to an external service (olakai.ai). While this is the intended purpose of the monitoring integration, it involves sending sensitive content including user prompts, LLM responses, and user metadata (e.g., userEmail).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which creates a surface for indirect prompt injection via the monitoring pipeline.
  • Ingestion points: The skill ingests raw userMessage and response.choices[0].message.content (found in SKILL.md).
  • Boundary markers: There are no delimiters or boundary markers used when passing this data to the olakai() tracking function.
  • Capability inventory: The skill uses the SDK to transmit captured data to the external olakai.ai domain.
  • Sanitization: The provided examples do not include sanitization or filtering of prompts or responses before they are transmitted to the external service.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 09:33 AM