iblai-api-agent-skill
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: All network operations target the official vendor domain (
api.iblai.app). The skill uses standard HTTP methods (GET, POST, PATCH, DELETE) to manage resources. - [SAFE]: The skill follows security best practices by using environment variables (
$IBLAI_API_KEY,$IBLAI_ORG) for authentication and configuration, avoiding hardcoded secrets. - [INDIRECT_PROMPT_INJECTION]: The skill processes skill "instructions" and "descriptions" from a shared organizational catalog. This is a standard capability for management tools but represents a surface where an agent might ingest instructions authored by other users.
- Ingestion points: Platform skill catalog (
/agent-skills/) and agent-assigned skills (/skills/) endpoints. - Boundary markers: None identified in the skill documentation.
- Capability inventory: Network communication with the ibl.ai API via
curl. - Sanitization: No explicit sanitization or validation of the fetched instruction strings is mentioned.
Audit Metadata