emitting-api-events
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of infrastructure that handles untrusted external data (API mutations) and forwards it to external URLs and real-time clients.
- Ingestion points: Data enters the system via API request bodies for mutations (cataloged in Instruction 1 of SKILL.md) and user-defined webhook subscription URLs.
- Boundary markers: Implementation examples in
references/examples.mduse JSON serialization to wrap data in event envelopes, providing structured boundaries. - Capability inventory: The skill requires network capabilities via
fetchfor webhook delivery and file system tools (Write,Edit,Bash) to generate implementation code. - Sanitization: While the skill includes HMAC-SHA256 signing for transmission integrity, it lacks explicit instructions to sanitize the payload content itself against instruction injection targeting downstream consumers.
Audit Metadata