cekura-onboarding
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides a step-by-step onboarding walkthrough for the Cekura platform, utilizing official vendor domains (cekura.ai) for all API interactions, documentation, and dashboard links. It properly handles sensitive information by using placeholders (e.g., ) and recommending secure configuration methods via the Claude Code plugin.
- [SAFE]: Analysis of the skill instructions and references shows no evidence of obfuscation, data exfiltration, or malicious persistence mechanisms. All external calls are scoped to the author's verified infrastructure.
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface as it ingests untrusted user-provided agent system prompts to configure the platform. 1. Ingestion points: User-provided agent description and system prompt (SKILL.md Phase 2.1). 2. Boundary markers: Absent; the skill does not instruct the agent to use delimiters or ignore instructions within the ingested prompt. 3. Capability inventory: The skill performs network operations via the Cekura API (api.cekura.ai) to create agents, generate scenarios, and run tests. 4. Sanitization: Absent; the ingested content is used directly in API payloads. This surface is necessary for the skill's primary function of configuring voice AI agents.
Audit Metadata