sirv-api

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill interacts with the official Sirv API at api.sirv.com and provides links to official documentation at sirv.com and apidocs.sirv.com. These are legitimate endpoints for the image management service described.
  • [INDIRECT_PROMPT_INJECTION]: The skill enables the agent to ingest data from external sources via the Sirv API, which could potentially contain malicious instructions. 1. Ingestion points: API responses from readdir, meta, stat, and search endpoints as described in SKILL.md and reference files. 2. Boundary markers: The instructions do not define specific delimiters or instructions to ignore potentially malicious content embedded in the retrieved metadata. 3. Capability inventory: The skill provides patterns for file operations including upload, delete, copy, rename, and account setting updates via fetch or curl commands. 4. Sanitization: There are no explicit instructions for sanitizing or validating the content of metadata or file paths retrieved from the API before use in downstream tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 08:32 AM