iblai-api-course-create
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill follows security best practices by instructing the agent to use environment variables ($IBLAI_API_KEY, $IBLAI_ORG, $IBLAI_USERNAME) for authentication rather than hardcoding sensitive information.
- [EXTERNAL_DOWNLOADS]: Network operations are restricted to the official vendor API at api.iblai.app, which is appropriate for the skill's stated purpose.
- [PROMPT_INJECTION]: The skill processes data from external API responses, which represents a surface for indirect prompt injection. 1. Ingestion points: Data enters the context from GET requests to api.iblai.app. 2. Boundary markers: No delimiters or warnings are used for ingested content. 3. Capability inventory: The agent can perform GET, POST, and DELETE requests to the course creation API. 4. Sanitization: No content validation or sanitization is described in the instructions.
Audit Metadata