saudi-telecom
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill correctly instructs users to use environment variables (
STC_API_KEY,MOBILY_TOKEN,ZAIN_TOKEN) rather than hardcoding credentials in the instructions or code samples. - [SAFE]: All network operations (curl commands) target the official developer portals of well-known Saudi telecommunications companies (stc.com.sa, mobily.com.sa, zain.com).
- [DATA_EXPOSURE]: The skill uses placeholders and environment variables for authentication, which is a recommended security practice for managing API secrets.
- [PROMPT_INJECTION]: The skill contains potential surfaces for indirect prompt injection where provider responses are interpolated into the final output (e.g.,
{{ provider }},{{ status }}). This is a common pattern in agent skills and is considered a low-level risk factor for data poisoning if the upstream API returns malicious content.
Audit Metadata