httpx
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes methods for fetching and processing data from external network sources, which introduces an attack surface for indirect prompt injection. \n
- Ingestion points: Network responses fetched via httpx.get, client.get, and streaming methods such as aiter_bytes (SKILL.md). \n
- Boundary markers: The provided documentation does not include use of delimiters or instructions for the agent to ignore embedded commands within response data. \n
- Capability inventory: The skill provides comprehensive outbound network capabilities (GET, POST, PUT, DELETE), file upload support, and proxy configuration. \n
- Sanitization: The usage examples do not demonstrate sanitization or validation of content received from external APIs before processing. \n- [EXTERNAL_DOWNLOADS]: The skill instructions include commands to install packages from the Python Package Index. \n
- Evidence: pip install httpx, pip install httpx-retry (SKILL.md). \n- [REMOTE_CODE_EXECUTION]: The skill provides instructions for installing third-party Python packages, which involves executing code from a remote registry. \n
- Evidence: Package installation commands located in the installation section (SKILL.md).
Audit Metadata