lottiefiles-library-account
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with external LottieFiles account and library data, creating a potential vector for indirect instructions hidden in resource names or metadata.
- Ingestion points: Results from the
lf_graphqltool calls, including user library and account data. - Boundary markers: The skill instructions do not explicitly mandate delimiters or specific safety wrappers for data returned from the API before it is processed by the agent.
- Capability inventory: The skill is scoped to the capabilities of the connected LottieFiles account, enabling search, inspection, and modification of resources.
- Sanitization: The instructions advise using GraphQL variables to prevent injection into queries and explicitly prohibit logging sensitive tokens or query variables.
Audit Metadata