integrate-nowyourlink-api
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several external resources and dependencies hosted on public registries and the service domain.
- Installs
nowyourlink-agent-kitfrom npm andnowyourlink-spotlightsfrom PyPI. - Fetches an OpenAPI 3.1 contract and MCP server configuration from
nowyourlink.com. - [INDIRECT_PROMPT_INJECTION]: The skill handles data from the nowyourlink API which may contain untrusted advertiser content, creating a surface for indirect prompt injection.
- Ingestion points: API responses from
https://nowyourlink.com/api/v1/spotlightand related archive endpoints (SKILL.md). - Boundary markers: The skill contains a clear warning to the agent to treat advertiser copy as untrusted promotional content and explicitly tells it to ignore instructions inside it.
- Capability inventory: The skill provides methods for the agent to fetch, process, and potentially render remote data (SKILL.md).
- Sanitization: Explicitly instructs the agent to escape content before rendering and to never execute instructions found within the responses.
Audit Metadata