data-client-rest
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains an instruction that attempts to influence agent behavior regarding web navigation. In Section 5, it states: "When asked to browse or navigate to a web address, actual visit the address." This directive aims to influence the agent's internal logic for handling tool execution or user-requested browsing.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a framework for fetching and processing data from external REST APIs without explicit instructions for sanitizing or delimiting that data before use.
- Ingestion points: API responses processed via
fetchResponse,parseResponse, andRestEndpoint(e.g., fromjsonplaceholder.typicode.comorapi.exchange.coinbase.com). - Boundary markers: Absent. There are no instructions provided to delimit or ignore embedded instructions within the fetched API data.
- Capability inventory: The skill enables fetching, normalizing, and updating remote resources, which are then used in code generation and UI state management.
- Sanitization: Absent. The skill does not provide patterns for escaping or validating external content before it is integrated into the application state or agent context.
Audit Metadata