apollo-local-dev-loop
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill demonstrates secure credential handling by utilizing
.envfiles for API keys and explicitly instructing the agent to add these files to.gitignoreto prevent accidental exposure in repositories. - [SAFE]: The HTTP client configuration includes interceptors designed to log only metadata (HTTP methods, URLs, and status codes) while specifically avoiding the logging of sensitive contact data or credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from the Apollo.io external API, which represents a potential surface for indirect prompt injection if the API source is compromised.
- Ingestion points: API response data is ingested and processed within
src/apollo/dev-client.tsand the MSW mock handlers. - Boundary markers: No specific boundary markers or "ignore instructions" delimiters are implemented in the provided code templates for processing API data.
- Capability inventory: The skill environment allows for
Bash,Write, andEditoperations. - Sanitization: The provided implementation examples do not include explicit sanitization or validation logic for the content received from the external API endpoints.
Audit Metadata