sirv-api
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with the official Sirv API at api.sirv.com and provides links to official documentation at sirv.com and apidocs.sirv.com. These are legitimate endpoints for the image management service described.
- [INDIRECT_PROMPT_INJECTION]: The skill enables the agent to ingest data from external sources via the Sirv API, which could potentially contain malicious instructions. 1. Ingestion points: API responses from readdir, meta, stat, and search endpoints as described in SKILL.md and reference files. 2. Boundary markers: The instructions do not define specific delimiters or instructions to ignore potentially malicious content embedded in the retrieved metadata. 3. Capability inventory: The skill provides patterns for file operations including upload, delete, copy, rename, and account setting updates via fetch or curl commands. 4. Sanitization: There are no explicit instructions for sanitizing or validating the content of metadata or file paths retrieved from the API before use in downstream tasks.
Audit Metadata