bfl-api
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows industry-standard security practices for API key management. It provides clear instructions to store sensitive credentials in environment variables and recommends using .env files combined with .gitignore to prevent accidental leakage in version control.
- [SAFE]: The network operations documented in the cURL examples and client scripts (Python and TypeScript) are strictly limited to the official BFL API domains (api.bfl.ai). There is no evidence of data exfiltration to unauthorized or suspicious external domains.
- [SAFE]: All provided code samples are transparent and use well-known libraries (such as requests in Python and fetch/axios in Node.js). The scripts do not use dangerous functions like eval() or exec(), nor do they attempt to execute remote code from untrusted sources.
- [SAFE]: The skill's behavior is entirely consistent with its stated purpose of being an API integration guide. There are no persistence mechanisms, privilege escalation attempts, or hidden instructions designed to bypass agent safety protocols.
Audit Metadata