iblai-api-analytics
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [SAFE]: The skill provides structured documentation for accessing the ibl.ai analytics API. It correctly handles sensitive information by referencing environment variables (
$IBLAI_API_KEY,$IBLAI_ORG,$IBLAI_USERNAME) instead of hardcoding credentials. - [SAFE]: Network operations are directed exclusively to the vendor's official API domain (
api.iblai.app), representing legitimate vendor functionality. - [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection through the ingestion of user-generated data.
- Ingestion points: API endpoints for retrieving chat transcripts and messages (
SKILL.mdunder the Transcripts section). - Boundary markers: Absent; transcript content is processed without explicit delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill's capabilities are limited to performing network GET and POST requests to the platform's analytics and reporting endpoints.
- Sanitization: No sanitization or content validation for the retrieved transcript data is specified.
- [NO_CODE]: The skill contains only instructional markdown and API call templates; it does not include any executable scripts, binary files, or external code dependencies.
Audit Metadata