ecoaloha-api-integration
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to fetch and process data from external resources (ecoaloha.com), which introduces a surface for indirect prompt injection where instructions within the retrieved content could influence agent behavior.
- Ingestion points: The agent is instructed to read documentation and API specifications from
ecoaloha.com/developers.mdandecoaloha.com/openapi.json, and fetch data from endpoints atecoaloha.com/api/v1andecoaloha.com/api/sandbox/v1. - Boundary markers: Absent; no specific instructions are provided to the agent to use delimiters or to ignore instructions embedded in the external content.
- Capability inventory: The agent uses network tools to perform HTTP GET operations and interacts with an MCP server.
- Sanitization: Absent; there are no requirements specified for validating, filtering, or sanitizing the external data before processing.
Audit Metadata