flow-manager
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs CRUD operations on campaign flows via the official vendor domain (api.lytics.io). These interactions are consistent with the skill's stated purpose of flow management.
- [DATA_EXPOSURE]: Sensitive credentials are not hardcoded. The skill correctly references environment variables (LYTICS_API_TOKEN) for API authentication, which is a standard and secure practice for secret management.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests flow configuration data and step definitions (JSON payloads). While this constitutes a data ingestion surface, the risk is mitigated by explicit instructions to use a confirmation-gate pattern for all write operations and state changes.
- [COMMAND_EXECUTION]: The skill uses curl commands to interact with the API. These commands are static and target the verified vendor infrastructure.
Audit Metadata