iblai-api-hosting
Fail
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads an OpenAPI schema from the vendor's official API endpoint (api.iblai.app) to ensure API request compatibility and validate field names.
- [COMMAND_EXECUTION]: Employs standard curl commands to interact with the ibl.ai API and grep for searching the local schema file in the /tmp directory.
- [INDIRECT_PROMPT_INJECTION]: * Ingestion points: The skill retrieves and displays build log tails (build_log_tail) from the hosting provider via the deployment detail endpoint. * Boundary markers: There are no explicit delimiters specified to isolate untrusted build log content from the agent's instructions. * Capability inventory: The skill utilizes network operations and multipart/form-data file uploads to manage project deployments. * Sanitization: The instructions do not define any sanitization or filtering logic for the ingested build logs.
Recommendations
- HIGH: Downloads and executes remote code from: https://api.iblai.app/dm/api/docs/schema/ - DO NOT USE without thorough review
Audit Metadata