api-integration-builder
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a best-practices guide for building API integrations. It includes detailed instructions on secure authentication (OAuth 2.0, API keys), request management with rate limiting, and secure webhook handling.
- [SAFE]: All external references are to well-known, trusted services such as Slack, Stripe, and Google. The code snippets provided implement standard security patterns like HMAC signature verification and token encryption.
- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing external data (webhooks/API responses). While the skill itself does not process runtime data, the integrations it helps build create ingestion surfaces for untrusted data. The skill mitigates this by teaching proper validation and signature verification.
- Ingestion points: Webhook payload (
req.body) and API responses. - Boundary markers: The skill instructs on implementing signature verification using
stripe.webhooks.constructEventand HMAC comparisons. - Capability inventory: The generated code typically includes database writes and network requests.
- Sanitization: Explicit instructions provided for cryptographic verification and data validation.
Audit Metadata