iblai-api-agent-llm
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill facilitates legitimate configuration management for the ibl.ai platform. It securely handles authentication using environment variables ($IBLAI_API_KEY) and targets official vendor endpoints at api.iblai.app, representing normal vendor functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external API to list available model providers. While this introduces a potential ingestion point for untrusted data, the source is a trusted vendor API used for its primary documented purpose.
- Ingestion points: API response from GET request to https://api.iblai.app/dm/api/ai-mentor/orgs/{org}/users/{username}/mentor-llms/ in SKILL.md.
- Boundary markers: Absent; the agent is instructed to select values directly from the returned provider/model list.
- Capability inventory: Performs network operations via curl to the iblai.app domain as documented in SKILL.md.
- Sanitization: Absent; the skill relies on string matching between the API response and the subsequent PUT request.
Audit Metadata