bloodbank-integration
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill describes a legitimate internal event bus architecture for the 33GOD ecosystem. All external resources and services mentioned (e.g., n8n.delo.sh, ntfy.delo.sh) are under the vendor's control, and sensitive credentials are appropriately handled via environment variables or secure vault references.\n- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from Plane webhooks, which constitutes an indirect prompt injection surface. This risk is mitigated by the following controls: 1. Ingestion points: Plane webhooks enter the system via a designated n8n ingress endpoint (references/event-journey.md). 2. Boundary markers: The system enforces mandatory HMAC signature verification over the raw request body using secrets resolved from a vault (references/event-journey.md). 3. Capability inventory: Validated events drive agent lifecycle tracking and command dispatch through the Hermes gateway (references/event-journey.md). 4. Sanitization: All incoming facts are normalized into provider-neutral formats and validated against strict JSON Schemas (references/schemas/README.md).
Audit Metadata