ai-api-integrations
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install official SDKs and CLI tools from established providers, including Anthropic's Claude Code runtime and various Node.js and Python packages. All referenced sources are official domains (e.g., claude.ai, npmjs.com).
- [COMMAND_EXECUTION]: The documentation describes the use of integrated tools for terminal operations (Bash) and code execution (Python) as provided by the Anthropic and xAI platforms. These are documented as core functionalities for building AI agents and for performing automated calculations or tests.
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates patterns for building RAG (Retrieval-Augmented Generation) systems where external data from databases or user inputs is interpolated into AI prompts. This inherent attack surface is mitigated by the skill's strong emphasis on best practices, such as strict input validation with Zod and the use of structured output formats.
- [DATA_EXPOSURE]: The skill provides examples for .env files containing API key placeholders and provides clear guidance on keeping sensitive credentials server-side. It specifically warns against common anti-patterns such as exposing secret keys in frontend code.
Audit Metadata