iblai-api-profile
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill manages credentials securely by referencing environment variables ($IBLAI_API_KEY, $IBLAI_ORG, $IBLAI_USERNAME) rather than hardcoding sensitive information.
- [SAFE]: All network requests are restricted to the vendor's official API host (api.iblai.app), ensuring data is transmitted to the intended service.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-generated content from profile fields and uploaded résumés, creating a surface for indirect prompt injection. Ingestion points: account metadata, education list, experience list, and résumé endpoints (SKILL.md). Boundary markers: none identified. Capability inventory: network write access via PATCH, POST, and PUT to vendor endpoints. Sanitization: none specified.
Audit Metadata