iblai-api-profile-metadata
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill performs network requests via curl to the official domain api.iblai.app. These requests are used to manage per-user metadata, which is the stated and primary purpose of the skill. The use of this vendor-controlled domain is considered safe in the context of the skill's author.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external source that is incorporated into the agent's context. Ingestion Point: The metadata object returned by the GET request to api.iblai.app in SKILL.md. Boundary Markers: None are explicitly defined in the prompt instructions. Capability Inventory: Includes network operations via curl for reading and writing data. Sanitization: The developer guide in references/guide.md recommends that client applications allowlist keys to ensure only expected data is processed, which provides a layer of defense against malicious data content.
Audit Metadata