integrate-agentkit

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill enables agents to fetch and summarize data from external platforms (e.g., GitHub, Gmail). This introduces a risk of indirect prompt injection if the external data contains malicious instructions designed to subvert the agent's logic.
  • Ingestion points: Data returned from actions.execute_tool in SKILL.md and framework tool helpers in references/frameworks.md.
  • Capability inventory: The skill provides access to authenticated third-party service tools and execution via the Scalekit SDK.
  • Boundary markers: No specific delimiters or "ignore instructions" warnings are defined in the code samples.
  • Sanitization: The instructions do not prescribe specific sanitization or validation steps for content retrieved from external tools.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the vendor's official SDKs (scalekit-sdk-python, @scalekit-sdk/node) and standard integration packages for LangChain and Google ADK. These are legitimate resources provided by the skill author and well-known framework maintainers.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 09:58 PM