donorperfect-api
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill consists entirely of reference documentation in Markdown and JSON formats. It does not include any scripts, binaries, or configuration files that execute code or automate tasks.
- [SAFE]: All referenced external domains, including donorperfect.net and softerware.force.com, are legitimate and well-known service endpoints for the DonorPerfect constituent management system.
- [SAFE]: The documentation for API authentication follows security best practices by using placeholders and instructing the user/agent on how to handle sensitive API keys without hardcoding them.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for ingesting data from the DonorPerfect API. However, the data source is a reputable service, and the documentation focuses on structured XML retrieval without providing automated processing scripts, thus relying on the agent's core safety protocols.
- Ingestion points: XML API responses from donorperfect.net described in SKILL.md.
- Boundary markers: Explicit XML schema documentation (record/field tags) provided in SKILL.md.
- Capability inventory: None (the skill provides no tools or scripts).
- Sanitization: Not applicable as no processing code is included.
Audit Metadata