maintainx-sdk-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and processing of data from an external source (MaintainX API), creating a surface where untrusted data could influence agent behavior.
- Ingestion points: External data enters the context via API client methods in
SKILL.mdandreferences/implementation-guide.md(e.g.,getWorkOrders,getAssets,getUsers). - Boundary markers: The provided implementation patterns do not demonstrate the use of delimiters or specific instructions to the agent to disregard natural language instructions found within the fetched API data.
- Capability inventory: The skill configuration includes
Write,Edit, andBash(npm:*)capabilities, which could be misdirected if the agent obeys instructions embedded in API responses. - Sanitization: No explicit sanitization or content validation for the API response body is present in the example SDK code.
Audit Metadata