octav-api
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of documentation and integration examples for the Octav API. All network activity is directed to the vendor's verified domains (octav.fi, api.octav.fi, data.octav.fi).
- [CREDENTIALS_UNSAFE]: The skill provides clear guidance on authentication, explicitly instructing users to store their API key in an environment variable (OCTAV_API_KEY) and warning against hardcoding credentials in code.
- [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface because it processes untrusted data from the blockchain (such as transaction metadata, token symbols, and protocol names). As a documentation skill, it facilitates the retrieval of this data without implementing specific sanitization logic.
- Ingestion points: Data returned from endpoints like
https://api.octav.fi/v1/transactionsandhttps://api.octav.fi/v1/portfolio. - Boundary markers: None provided in the fetch examples.
- Capability inventory: No system-level capabilities (file writes, command execution) are implemented in the skill's scripts.
- Sanitization: No explicit sanitization or filtering is described for the processed blockchain data.
Audit Metadata