cbdb-api
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to the Harvard University CBDB API (
cbdb.fas.harvard.edu) to fetch biographical records. This is a well-known academic service and its usage is entirely consistent with the skill's stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the CBDB API (ingestion point:
scripts/cbdb_api.py). While this creates a potential surface for indirect prompt injection, the risk is minimal because the skill's functionality is limited to data retrieval and summarization, and it lacks dangerous capabilities like file writing or system command execution. - [SAFE]: No obfuscation, hardcoded credentials, or persistence mechanisms were detected. The Python implementation follows secure coding practices, using only standard library modules and providing clear documentation for its operations.
Audit Metadata