extension-http-outcalls
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and implementation guidelines for making HTTP requests in a specialized environment (Internet Computer). It emphasizes defensive coding practices, such as response size bounding and server-side filtering, to mitigate Denial of Service (DoS) risks related to instruction limits.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from APIs, which presents a potential surface for indirect prompt injection.
- Ingestion points: Data is fetched via
OutCall.httpRequest,OutCall.httpGetRequest, andOutCall.httpPostRequestas demonstrated inSKILL.md. - Boundary markers: The skill enforces strict response limits, capping payloads at 1 MB (
defaultMaxResponseBytes) and 10,000 entries. - Capability inventory: The skill allows network outcalls (GET, POST, PUT, DELETE, PATCH) to the internet.
- Sanitization: The skill mandates size-based validation via
check_canister_api_compliancebut relies on the developer for content-level sanitization. These resource limits are considered safe practices for the target platform.
Audit Metadata