ramp-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for fetching data from the Ramp API (corporate cards and expenses). This introduces a potential surface for indirect prompt injection if the data retrieved from the external API contains instructions intended to manipulate the agent.
- Ingestion points: Card data is fetched from the Ramp API in
SKILL.mdusing therequestslibrary. - Boundary markers: The example code does not include specific delimiters or instructions to ignore embedded content within the API response.
- Capability inventory: The skill utilizes the
requestslibrary for network communication andosfor environment variable access. - Sanitization: There is no evidence of response data sanitization or validation in the provided code snippet.
Audit Metadata