elfa-api
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill interacts with official Elfa AI services. All specified endpoints and documentation links point to the vendor's primary domains (api.elfa.ai, go.elfa.ai, docs.elfa.ai).
- [COMMAND_EXECUTION]: The skill uses the bash_tool to execute curl for making network requests to the Elfa API. This behavior is documented and necessary for the skill's functionality.
- [DATA_EXFILTRATION]: The skill manages authentication via an ELFA_API_KEY environment variable. It explicitly instructs the AI agent to mask this key and avoid logging or exposing it in outputs, which is a standard security precaution.
- [SAFE]: The skill includes an attack surface for indirect prompt injection as it processes data from external social media sources. Evidence: 1. Ingestion points: API responses from api.elfa.ai containing social mentions and news. 2. Boundary markers: Absent in the instructions to the agent. 3. Capability inventory: bash_tool used for curl requests. 4. Sanitization: Absent, relying on the agent's default parsing. However, as the skill's primary purpose is data presentation and it does not grant the processed data control over sensitive operations, this is considered a standard operational risk.
Audit Metadata