iblai-api-agent-disclaimer
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill interacts with api.iblai.app, which is a recognized vendor resource for the author iblai. It correctly utilizes environment variables such as $IBLAI_API_KEY for authorization instead of hardcoding credentials.
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks as it retrieves external text (disclaimers) via the API and introduces it into the agent's context. 1. Ingestion points: GET requests to agent settings and disclaimer endpoints in SKILL.md. 2. Boundary markers: The skill does not provide specific instructions to the agent on how to delimit or ignore instructions within the retrieved text. 3. Capability inventory: Uses curl for API requests. 4. Sanitization: No specific sanitization or validation logic is defined for the fetched disclaimer content.
Audit Metadata