shortcut
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides configuration instructions and usage examples for the Shortcut connector. It uses environment variable placeholders for API keys and links to official documentation from trusted organizations (apideck.com and shortcut.com).
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data from the Shortcut API through a proxy.
- Ingestion points: Interaction with Shortcut's native API responses as proxied by Apideck.
- Boundary markers: The current documentation does not explicitly mention markers or instructions to delimit untrusted API data.
- Capability inventory: The agent is instructed to use network-capable tools (like curl) to perform requests to the Proxy API.
- Sanitization: No specific data sanitization or validation routines are specified within the instructional text.
Audit Metadata