extension-http-outcalls

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the caffeineai-http-outcalls Motoko library as a required dependency. This library is provided by the vendor to handle backend network requests.
  • [COMMAND_EXECUTION]: Instructions direct developers to use the curl command locally to verify REST API responses and suggest the use of a check_canister_api_compliance tool during the deployment process to ensure safety compliance.
  • [PROMPT_INJECTION]: The skill facilitates the ingestion of external data via HTTP outcalls, creating a surface for indirect prompt injection. Ingestion points: Data is fetched from remote APIs using the httpRequest and httpGetRequest functions in src/backend/main.mo. Boundary markers: The Motoko actor implements a transform query function to process and normalize external responses. Capability inventory: The skill enables backend network outcalls and data parsing. Sanitization: The skill mandates strict response size limits and entry counts to mitigate resource exhaustion, though data-level sanitization depends on the implementation of the transform function.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 03:36 PM
Security Audit — agent-trust-hub — extension-http-outcalls