seam-access-codes
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the
seamSDK via standard package managers. The packages are legitimate resources provided by the vendor,seamapi.\n- [REMOTE_CODE_EXECUTION]: The skill advises against pinning SDK versions during installation. While this ensures access to the latest features, pinning specific versions is a security best practice for production environments to maintain stability and prevent risks from unexpected upstream changes.\n- [PROMPT_INJECTION]: The skill facilitates the ingestion of external data from room bookings and webhooks to manage physical lock credentials, creating an attack surface for indirect prompt injection.\n - Ingestion points: Data is pulled from booking objects (e.g., guest names) and webhook payloads as described in the integration examples in
SKILL.md.\n - Boundary markers: The code examples do not use explicit delimiters to isolate untrusted input from instruction logic.\n
- Capability inventory: The skill modifies application source code and uses the Seam API to control physical security hardware.\n
- Sanitization: The provided examples do not include explicit sanitization or validation of the processed data before it is sent to the Seam API.
Audit Metadata