digits
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues were detected. The skill implements standard integration patterns for a third-party accounting service and utilizes secure environment variable practices for secret management as shown in the TypeScript example.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process financial data from external sources, which presents a surface for indirect prompt injection if that data contains malicious instructions.
- Ingestion points: Fetches ledger accounts, journal entries, invoices, and financial reports from the Digits API via Apideck.
- Boundary markers: The instructions do not define specific delimiters or "ignore" instructions for the ingested financial data.
- Capability inventory: The agent can read, write, and reconcile financial records using the @apideck/unify SDK or the Apideck Proxy API.
- Sanitization: Standard API responses are processed without additional instruction-level filtering.
Audit Metadata