iblai-api-milestone
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill interacts with the vendor's API at
api.iblai.app. It utilizes sensitive information stored in environment variables ($IBLAI_API_KEY,$IBLAI_ORG,$IBLAI_USERNAME) to authenticate requests, which is the recommended approach for secure credential management in this environment. - [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface as it retrieves user completion data and skill point totals from external API endpoints. While this data is incorporated into the agent's context, the risk is minimal given the structured nature of the JSON responses (numerical scores and completion statuses). No explicit boundary markers are defined for the returned data.
- [COMMAND_EXECUTION]: The skill documentation includes
curlexamples for the agent to use. These commands are scoped to the primary purpose of the skill and target the vendor's verified API infrastructure.
Audit Metadata