b24jssdk-rest
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of data from external Bitrix24 REST API endpoints, which presents an attack surface for indirect prompt injection.\n
- Ingestion points: Data enters the agent's context through REST API responses from methods like
actions.v2.call.makeandactions.v3.callList.makeinSKILL.md.\n - Boundary markers: The SDK uses structured
AjaxResultobjects, but the skill does not implement specific boundary delimiters to prevent the agent from potentially following instructions embedded within data fields.\n - Capability inventory: The skill provides methods for executing network requests to Bitrix24 servers and managing the resulting data sets as documented in
SKILL.md.\n - Sanitization: The documentation describes a
redactSensitiveParamsfeature for logs, but does not specify a process for sanitizing or escaping the data returned from API calls before agent interaction.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes the@bitrix24/b24jssdkpackage and references documentation onbitrix24.github.io, which are official resources provided by the vendor.
Audit Metadata