iblai-api-inference
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill correctly uses environment variables ($IBLAI_API_KEY, $IBLAI_ORG) for authentication, which is a recommended practice for managing sensitive credentials.
- [DATA_EXFILTRATION]: The skill communicates with api.iblai.app and asgi.data.iblai.app. These are official domains associated with the author 'iblai' and are used for intended inference and model listing features.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content via the messages array in API requests to the completion endpoint. Ingestion points: messages field in SKILL.md. Boundary markers: Absent. Capability inventory: Network POST requests via curl. Sanitization: Absent. This is a standard surface for an inference API and does not represent an escalated risk in this context.
Audit Metadata