flexport-rate-limits
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from the Flexport API, creating a potential surface for indirect prompt injection if the external source provides malicious content.
- Ingestion points: Data is retrieved via
fetchcalls tohttps://api.flexport.comwithinSKILL.md. - Boundary markers: The instructions lack explicit delimiting or instructions to the agent to treat the external API responses as untrusted data.
- Capability inventory: The skill utilizes network access to perform GET requests for shipment information.
- Sanitization: API responses are converted to JSON and used directly without validation or sanitization shown in the snippets.
- [EXTERNAL_DOWNLOADS]: The skill references the use of an external library for concurrency management.
- Source: References the
p-queuelibrary, a well-known Node.js package available on GitHub. - Purpose: Used to implement queue-based throttling and interval capping for API requests.
Audit Metadata