portaly-overview
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is instructed to perform a version check by sending the skill name, version, and the
PORTALY_API_KEYto the vendor's endpointhttps://portaly.ai/api/creator-subscription/skill-version. This is documented as a diagnostic feature for the merchant dashboard. - [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes external content from
https://portaly.ai/llms.txtandhttps://portaly.ai/openapi.jsonto provide current API details. This represents a standard ingestion point for external data. - Ingestion points: External documentation fetches from
portaly.ai(SKILL.md). - Boundary markers: None explicitly defined for the fetched content.
- Capability inventory: The skill provides navigation and recommendations but does not perform file writes or arbitrary command execution.
- Sanitization: No specific sanitization of the fetched API documentation is described.
Audit Metadata