iblai-api-invite
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill interacts exclusively with the official ibl.ai vendor API (api.iblai.app). Usage of vendor infrastructure for its stated purpose is standard and safe.- [SAFE]: Authentication is handled through environment variables ($IBLAI_API_KEY), which is a recommended practice for secret management.- [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect injection by processing user-supplied CSV data for invitation requests. 1. Ingestion points: CSV rows in user data. 2. Boundary markers: The skill instructs the agent to confirm recipient lists with the user before execution. 3. Capability inventory: Network operations (POST) via curl. 4. Sanitization: Not explicitly specified; the skill relies on the destination API's validation.- [COMMAND_EXECUTION]: The skill utilizes curl to interact with the API. These commands are specific to the tool's management functions and target official endpoints.
Audit Metadata