adapt-custom-endpoint

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external content from media provider documentation and API responses to configure custom endpoints.
  • Ingestion points: Instructions in SKILL.md direct the agent to read supplier documentation from URLs provided by the user and process JSON response samples.
  • Boundary markers: The agent is tasked with summarizing and extracting values from these external sources to build or verify JSON definitions without specific prompt delimiters.
  • Capability inventory: The scripts/custom_endpoint.py script enables authenticated network communication with the ArcReel API (POST, GET, PUT) for validation and testing.
  • Sanitization: The script performs validation on JSON files and enforces strict URL formatting (ASCII-only, HTTPS required for non-loopback hosts) before sending data to the API.
  • [EXTERNAL_DOWNLOADS]: The skill references the official GitHub repository for the ArcReel project to provide technical schema definitions.
  • Evidence: references/definition-format.md contains a link to the ArcReel/ArcReel repository for the JSON schema.
  • [CREDENTIALS_SAFE]: The skill implements standard security practices for managing sensitive authentication tokens.
  • Evidence: scripts/custom_endpoint.py is designed to retrieve the API key from a local configuration file (.arcreel/settings.json) or environment variables (ARCREEL_API_TOKEN) rather than hardcoding them or accepting them through potentially logged command-line arguments.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 03:57 PM