channel3-api
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security risks were identified in the skill instructions or referenced files. The skill correctly implements a product search API integration.
- [EXTERNAL_DOWNLOADS]: The skill references official SDKs (@channel3/sdk, channel3-sdk) and a CLI tool (@channel3/cli) available via standard registries. It also provides instructions for installing components from the vendor's own shadcn registry at ui.trychannel3.com. All resources originate from the verified vendor infrastructure.
- [COMMAND_EXECUTION]: Includes standard terminal command examples for dependency installation and API exploration via the official Channel3 CLI tool. These are benign development instructions.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data through search queries and merchant URL lookups. 1. Ingestion points: 'query' and 'url' parameters in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Network requests to api.trychannel3.com in SKILL.md. 4. Sanitization: Absent. This surface is inherent to the primary function of a product search skill and is mitigated by the host agent's native safety guardrails.
Audit Metadata