jinko-sdk-setup
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/check_jinko_connection.pyfetches version information from PyPI (pypi.org), which is a well-known and trusted service. This is used to notify the user if their SDK is outdated.- [COMMAND_EXECUTION]: The skill provides instructions to execute a local validation script and standard Python package installation commands (pip install). This is consistent with the skill's purpose of environment setup.- [DATA_EXFILTRATION]: While the skill accesses sensitive environment variables (JINKO_API_KEY,JINKO_PROJECT_ID), it implements redaction for any printed output and only communicates with the official Jinkō API. The use of.envfiles for secret management is a recommended safe practice.- [INDIRECT_PROMPT_INJECTION]: The skill processes external environment variables, creating a potential surface for indirect prompt injection. However, the risk is mitigated by the script's focus on configuration verification and the implementation of redaction for sensitive data. - Ingestion points: Environment variables in
scripts/check_jinko_connection.py. - Boundary markers: No explicit boundary markers for environment variables.
- Capability inventory: Network access to PyPI and Jinkō API; command execution for SDK installation in
scripts/check_jinko_connection.py. - Sanitization: Uses a
redact()function to mask sensitive values in output.
Audit Metadata