insforge-integrations
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The documentation instructs users to execute shell commands using the npx package runner to interact with the vendor-provided CLI tool (@insforge/cli). This tool is used for legitimate administrative tasks such as retrieving JWT secrets and performing database migrations.- [INDIRECT_PROMPT_INJECTION]: The market report generation logic in the OKX payment guide creates a surface for indirect prompt injection by interpolating data directly into an AI prompt.
- Ingestion points: Market snapshot data generated in src/app/api/report/route.ts.
- Boundary markers: No delimiters or instructions to ignore embedded commands are present in the AI report prompt.
- Capability inventory: The associated environment has capabilities for database writes to the payments ledger and network requests to external facilitators.
- Sanitization: No escaping or validation is applied to the interpolated market data.- [EXTERNAL_DOWNLOADS]: The integration guides recommend installing and using standard packages from well-known technology providers, including Auth0, Clerk, Better Auth, Viem, and OpenAI. These downloads target official registries and trusted service domains.
Audit Metadata