req-http-client
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for ingesting untrusted external data via API requests and writing it to the local file system.
- Ingestion points: External data is fetched from remote servers using
Req.getandReq.postmethods inSKILL.mdandassets/req_client_snippets.ex. - Boundary markers: Absent; the skill does not suggest the use of delimiters or warnings to prevent the agent from interpreting fetched data as new instructions.
- Capability inventory: The skill utilizes network capabilities through the
Reqclient and performs file system writes usingFile.stream!. - Sanitization: Absent; while the code provides robust HTTP status code handling, it does not include patterns for sanitizing or validating the content of the response bodies before they are processed by the agent.
Audit Metadata