integrations-prior-art-survey
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
uv runto execute a local Python validation script (scripts/validate_integrations_prior_art.py). This script validates YAML artifacts against JSON schemas and internal business rules using safe practices likeyaml.safe_load. The test suite also usessubprocess.runto execute this local script during the development/testing process. - [EXTERNAL_DOWNLOADS]: The search procedures utilize
gh apiandcurlto fetch integration metadata from established services and repositories. These include GitHub organizations (NangoHQ, ActivePieces, n8n-io, PipedreamHQ), API aggregators (apis-guru), and official specification domains (cloudevents.io, asyncapi.com). These sources are recognized as trusted technology providers. - [INDIRECT_PROMPT_INJECTION]: The instructions in
SKILL.mdexplicitly acknowledge the risk of malicious instructions being embedded in integration descriptors and registry descriptions. It mandates a security posture where all external content is treated as untrusted data rather than instructions, and requires the agent to neutralize any detected injection attempts before recording the results.
Audit Metadata