netsuite
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from NetSuite records (e.g., invoices, bills, customers) which can serve as a vector for indirect prompt injection if the source data is attacker-controlled.
- Ingestion points: Methods like
apideck.accounting.invoices.listretrieve external records into the agent context. - Boundary markers: The skill does not define specific markers or instructions to isolate or ignore instructions embedded in this external data.
- Capability inventory: The skill uses the Apideck Unified API and Proxy API to perform network operations.
- Sanitization: No sanitization or validation logic for the fetched external content is provided.
- [EXTERNAL_DOWNLOADS]: The skill references the official
@apideck/unifyNode.js library and provides links to authoritative documentation and API specifications on official Apideck and Oracle NetSuite domains.
Audit Metadata