provider-integration
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the creation and execution of shell scripts in the
scripts/providers/directory to facilitate AI interactions. This is a core part of its intended functionality for extending the agent's capabilities. - [EXTERNAL_DOWNLOADS]: The provided templates use
curlto communicate with well-known and trusted AI service providers including Google, OpenAI, Anthropic, Mistral, and Cohere. All network activity is directed toward official API endpoints. - [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted user input (prompts) through command-line arguments. The provided script templates mitigate injection risks by using
jqwith argument binding (--arg) to properly escape and serialize input before it is sent to external APIs. - [CREDENTIALS_SAFE]: The skill correctly instructs the user to store API keys in environment variables rather than hardcoding them within the scripts, adhering to standard security practices for local development tools.
Audit Metadata