inngest-api-cli

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx to run inngest-cli@latest, which is the official tool for Inngest, a well-known developer service. This is a standard practice for ensuring the latest operational tools are used.
  • [EXTERNAL_DOWNLOADS]: The skill references official Inngest documentation and API specifications hosted at api-docs.inngest.com to handle drift or specific API requirements.
  • [CREDENTIALS_UNSAFE]: The skill demonstrates high security awareness regarding credentials by explicitly instructing the agent to avoid passing API keys as inline flags (--api-key) to prevent exposure in process lists and transcripts. It also mandates that secrets and signing keys never be written to persistent files.
  • [DATA_EXFILTRATION]: Includes mandatory instructions to redact sensitive information, such as API tokens, signing keys, and webhook URLs, from all summaries and responses provided to the user.
  • [COMMAND_EXECUTION]: Provides specific, prescriptive command templates for the inngest-cli. It includes a safety check for the query-insights command, requiring the agent to inspect generated SQL before execution to prevent broad or expensive operations.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Inngest API responses (traces, event runs, and logs). It mitigates injection risks by instructing the agent to parse the JSON output structurally and to filter/redact sensitive payload content before presenting it to the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 07:20 PM
Security Audit — agent-trust-hub — inngest-api-cli