jinko-sdk-setup
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the "jinko-sdk" Python package and the "python-dotenv" library. It includes a proactive security warning to prevent dependency confusion attacks by distinguishing the legitimate "jinko-sdk" package from the unrelated "jinko" package found on the public registry.
- [COMMAND_EXECUTION]: The skill utilizes a built-in diagnostic command, "python -m jinko.cli.check_jinko_connection", to verify the environment. This tool validates API access and configuration using redacted outputs to prevent the accidental exposure of sensitive credentials like API keys or session codes.
- [INDIRECT_PROMPT_INJECTION]: The skill exposes an ingestion surface by using "client.search()" to retrieve and display project item data from the Jinkō API.
- Ingestion points: Project item metadata (names, descriptions) fetched from the external Jinkō API and displayed in the agent's context.
- Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the search results.
- Capability inventory: The skill enables shell command execution and Python script generation for interacting with the Jinkō SDK.
- Sanitization: No explicit sanitization or filtering of API-provided text is specified in the skill instructions.
Audit Metadata