iblai-api-catalog-invitation
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with an external API to retrieve catalog and invitation data, creating a potential surface for indirect instructions to enter the agent context. 1. Ingestion points: Data retrieved from GET endpoints at api.iblai.app. 2. Boundary markers: No explicit delimiters or instructions to ignore embedded content are provided. 3. Capability inventory: Includes the ability to perform network POST and DELETE operations to the vendor API. 4. Sanitization: There is no mention of sanitizing or validating the content returned from the API responses.
- [SAFE]: All network activity is directed to the vendor's own domain (api.iblai.app). Authentication is handled securely through the use of an environment variable ($IBLAI_API_KEY) rather than hardcoded secrets.
Audit Metadata