onlyfans-chat-summary
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted chat messages and fan profiles from the OnlyFans service. It mitigates injection risks by explicitly instructing the agent to treat this ingested data as source content only rather than instructions. Ingestion points include chat history and summary API endpoints. Capabilities are appropriately limited to fetching data and local summary generation.
- [CREDENTIALS_UNSAFE]: The skill uses an API key for authentication via OnlyFansAPI.com. It correctly instructs the agent to retrieve this from a secure customer store or environment variable and explicitly forbids printing, committing, or exposing the secret in responses.
- [EXTERNAL_DOWNLOADS]: The skill fetches public documentation and offers to connect Model Context Protocol (MCP) servers from
app.onlyfansapi.comanddocs.onlyfansapi.com. These URLs represent the vendor's own infrastructure and are used for primary functionality. The skill also requires user consent before connecting new servers.
Audit Metadata