lucidchart-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill uses the WebFetch tool to perform network operations for retrieving documentation and implementation contracts.
- Evidence: The skill fetches data from Lucid's developer site and from external source-system contracts provided during the implementation process. Fetches from Lucid's official documentation are neutral references to a well-known service, while source-system URLs are determined at runtime.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from third-party sources which could theoretically contain instructions designed to influence the agent's behavior during code generation.
- Ingestion points: Documentation and implementation contracts are retrieved via WebFetch in SKILL.md (Step 2) and references/official-docs.md.
- Boundary markers: There are no explicit instructions for the agent to use delimiters or ignore potential instructions within the fetched external documentation.
- Capability inventory: The agent is granted Write and Edit permissions to modify local project files and implement webhook logic based on the ingested data.
- Sanitization: The skill does not specify any sanitization or validation steps for the content retrieved from external sources before the agent processes it for code implementation.
Audit Metadata