linkup-fetch
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were identified. The skill implements documented functionality for interacting with the Linkup API.
- [DATA_EXFILTRATION]: Network requests are directed to the vendor's official API domain (api.linkup.so). Authentication is handled via a placeholder variable ($LINKUP_API_KEY), which is consistent with secure credential management practices.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external websites, creating a potential surface for indirect prompt injection. \n
- Ingestion points: Untrusted content is retrieved from arbitrary URLs using the fetch API defined in SKILL.md. \n
- Boundary markers: Instructions in SKILL.md guide the agent to extract only necessary information, reducing the likelihood of processing malicious instructions embedded in fetched pages. \n
- Capability inventory: Network access is required to communicate with the Linkup API service. \n
- Sanitization: There are no specific instructions for sanitizing or escaping the fetched content before processing.
Audit Metadata