external-api-integration
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [SAFE]: The skill defines secure and robust architectural patterns for API calls, including the mandatory use of timeouts to prevent service hangs and circuit breakers to manage upstream outages effectively.\n- [EXTERNAL_DOWNLOADS]: The skill references and encourages the use of highly reputable and well-known open-source libraries from official sources, including the Faraday HTTP client, Stoplight circuit breaker, and VCR for testing.\n- [CREDENTIALS_UNSAFE]: The code samples correctly demonstrate security best practices for secret management by using the Rails credentials system and implementing Faraday middleware to specifically filter 'Authorization' headers from application logs.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides structured patterns for ingesting data from external APIs. It uses proper JSON parsing and service object encapsulation, which helps mitigate risks when processing data from untrusted external endpoints.
Audit Metadata