iblai-api-search
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill interacts exclusively with the official vendor API domain
api.iblai.app. All network requests are for legitimate platform functionality. - [SAFE]: Sensitive information, such as API tokens, is managed through environment variables (
$IBLAI_API_KEY), adhering to secure secret management practices. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external API search results, including agent names, descriptions, and catalog content. This constitutes a potential injection surface.
- Ingestion points: Data is retrieved from the
mentors/,catalog/, andrecommendations/endpoints described inSKILL.md. - Boundary markers: No explicit boundary markers or instructions to ignore embedded content were identified in the instructions.
- Capability inventory: The skill provides discovery capabilities and administrative functions for prompt management via
POST,PUT, andDELETErequests. - Sanitization: No sanitization or filtering of API response data is documented.
Audit Metadata