pudu-openapi-skill
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill communicates exclusively with official Pudu Robotics API endpoints including open-platform.pudutech.com, css-open-platform.pudutech.com, csg-open-platform.pudutech.com, and csu-open-platform.pudutech.com. These are verified vendor resources consistent with the author 'pudu-robotics'.
- [CREDENTIALS_UNSAFE]: Instructions for handling ApiAppKey and ApiAppSecret strictly emphasize using environment variables. The skill body includes explicit safety rules forbidding the echoing of full secrets in logs, responses, or example code, and mandates desensitization (masking) for display.
- [COMMAND_EXECUTION]: Local scripts in JavaScript, Python, Go, Java, and C# are used to facilitate API requests. These scripts implement standard HMAC-SHA1 signing for authentication and do not execute arbitrary commands or use unsanitized user input in shell contexts.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests structured JSON data from robot status and task logs. While this creates a data ingestion surface, the data source is the vendor's own controlled API environment, and the instructions are limited to beautifying the output for the user.
Audit Metadata