iblai-api-crm
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents interactions with the ibl.ai CRM API endpoints at
api.iblai.app. This is a vendor-owned domain consistent with the skill author 'iblai'. - [SAFE]: Authentication is managed via the
$IBLAI_API_KEYenvironment variable. The skill correctly instructs users to run a setup command (/iblai-api-login) rather than hardcoding credentials. - [DATA_EXPOSURE_AND_EXFILTRATION]: While the skill accesses and modifies organizational CRM data (People, Deals, Activities), this behavior is consistent with its stated purpose of sales and relationship management. Data is transmitted only to the official vendor API.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses (e.g., Person names, Deal descriptions, metadata fields) which could theoretically contain malicious instructions.
- Ingestion points: REST GET requests to
/api/crm/endpoints inSKILL.md. - Boundary markers: None identified in the prompt templates.
- Capability inventory: Supports data retrieval and modification (POST/PATCH/DELETE) via REST API.
- Sanitization: Relies on the platform's default handling of API response data.
Audit Metadata