matrix-openapi-skill
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Matrix homeservers, creating a potential surface for indirect prompt injection attacks where malicious instructions could be embedded in room messages or state events.
- Ingestion points: Data is ingested via the
/syncendpoint and room state lookups (get:/rooms/{roomId}/state) as described inSKILL.mdandreferences/usage-patterns.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided for the content retrieved from the Matrix API.
- Capability inventory: The skill utilizes the
uxctool which possesses capabilities for network operations and file system writes (e.g., writing sync logs to$HOME/.uxc/subscriptions/matrix-sync.ndjson). - Sanitization: There is no evidence of sanitization or filtering of the content received from the Matrix API before it is processed by the agent.
Audit Metadata