miro-performance-tuning
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from the external Miro REST API, which creates a potential surface for indirect prompt injection if external board content contains malicious instructions.
- Ingestion points: Item data is fetched via
https://api.miro.com/v2/boards/${boardId}/itemsin thepaginateItemsfunction inSKILL.md. - Boundary markers: The code examples do not explicitly demonstrate the use of delimiters or boundary markers to isolate external data from the agent's primary instructions.
- Capability inventory: The skill is configured with
Read,Write, andEdittool permissions, and performs network requests to the Miro API. - Sanitization: The provided code snippets focus on performance logic (caching and pagination) and do not include specific sanitization or validation logic for the content of the retrieved Miro items.
Audit Metadata