upstash
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the agent to fetch documentation from the official Upstash domain (upstash.com). Upstash is a well-known technology service, and fetching official documentation is a standard procedure for ensuring the agent uses current API patterns.
- [PROMPT_INJECTION]: The use of strong instructional markers like 'CRITICAL' and 'MUST' serves to emphasize the importance of using up-to-date documentation. This is considered natural instructional language aimed at improving performance rather than an attempt to bypass security guardrails.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow where the agent ingests external data via a web fetch from upstash.com/docs/llms.txt. (1) Ingestion points: WebFetch instruction in SKILL.md. (2) Boundary markers: Absent. (3) Capability inventory: No executable scripts or tool definitions are present in the skill. (4) Sanitization: No explicit sanitization or filtering is applied to the fetched content. While this creates an ingestion surface, the risk is minimal given the content is technical documentation from a well-known service provider.
Audit Metadata