awesome-free-llm-apis
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides numerous code templates for integrating third-party LLM APIs. These templates represent a vulnerability surface where untrusted data (user inputs or model responses) could be used to influence agent behavior if not properly handled in a larger application context.
- Ingestion points: SKILL.md (Multiple Python and TypeScript code blocks demonstrate passing untrusted strings to the
messagesparameter of model clients). - Boundary markers: Absent; the integration examples do not include delimiters or instructions to ignore embedded commands within the data being sent to or received from the APIs.
- Capability inventory: The skill facilitates network operations via the
OpenAIclient,requestslibrary, andollamaclient to external domains. - Sanitization: Absent; the provided templates show direct interpolation of input variables without validation or escaping.
- [SAFE]: The skill correctly identifies secret management as a priority, explicitly instructing users to store API keys in environment variables rather than hardcoding them in scripts.
- [SAFE]: All external references and network endpoints target well-known and established technology providers, including Google, Microsoft (GitHub), Cloudflare, and NVIDIA.
Audit Metadata