castai-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto make authenticated requests to the official CAST AI REST API (api.cast.ai) andjqto parse the results. These are standard operations for a cloud management skill. - [DATA_EXPOSURE]: Authentication is managed through the
CASTAI_API_KEYenvironment variable. This is consistent with secure development practices for handling API credentials. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API endpoints. It uses
jqto select specific fields, which reduces the attack surface by limiting the processing of raw external data.
Audit Metadata