new-project
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows standard integration patterns for a monitoring service. All external package installations and network requests are directed to well-known or official service domains (NPM, PyPI, and olakai.ai). Credential management instructions correctly advise the use of environment variables rather than hardcoding secrets.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to collect and transmit untrusted data (user prompts and model responses) to a monitoring platform, creating an inherent data ingestion surface.
- Ingestion points: User inputs (
input,input_text) and model outputs (finalResponse,final_response) are passed into theolakai("event", ...)function in the TypeScript and Python examples withinSKILL.md. - Boundary markers: None. The raw text is passed directly to the telemetry function.
- Capability inventory: The skill leverages the Olakai SDK to perform network transmissions of this data to
app.olakai.ai. - Sanitization: No sanitization or filtering of the captured prompt/response content is present in the integration examples, which is standard for the intended purpose of observability and logging.
Audit Metadata