extension-http-outcalls
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the
caffeineai-http-outcallsMotoko library as a required dependency. This library is provided by the vendor to handle backend network requests. - [COMMAND_EXECUTION]: Instructions direct developers to use the
curlcommand locally to verify REST API responses and suggest the use of acheck_canister_api_compliancetool during the deployment process to ensure safety compliance. - [PROMPT_INJECTION]: The skill facilitates the ingestion of external data via HTTP outcalls, creating a surface for indirect prompt injection. Ingestion points: Data is fetched from remote APIs using the
httpRequestandhttpGetRequestfunctions insrc/backend/main.mo. Boundary markers: The Motoko actor implements atransformquery function to process and normalize external responses. Capability inventory: The skill enables backend network outcalls and data parsing. Sanitization: The skill mandates strict response size limits and entry counts to mitigate resource exhaustion, though data-level sanitization depends on the implementation of thetransformfunction.
Audit Metadata