together-webhooks-events
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests job output and error artifacts from Together AI via
WebFetch, creating a potential surface for indirect prompt injection if these artifacts contain malicious instructions. - Ingestion points: Job output and error files fetched during the job completion and reconciliation phase (SKILL.md).
- Boundary markers: Instructions advise mapping data to a versioned internal event schema, which provides structure, but lacks explicit boundary delimiters for potentially unstructured data in the artifacts.
- Capability inventory: The skill has access to
WebFetchfor data retrieval andWrite/Editfor event persistence. - Sanitization: The skill mentions schema mapping but does not specify validation or sanitization requirements for the content retrieved from Together AI.
- [EXTERNAL_DOWNLOADS]: The skill references and fetches information from Together AI official documentation and SDK repositories (
docs.together.ai,github.com/togethercomputer). These are recognized well-known service resources. - [CREDENTIALS_UNSAFE]: Mentions the use of
TOGETHER_API_KEY. The skill correctly includes instructions to maintain credential confidentiality, advising against exposing the key to callback consumers and recommending the use of approved secret stores.
Audit Metadata