openai-api
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security risks detected. The skill promotes safe usage of the OpenAI API by recommending environment variables for secret management and providing templates for content moderation. Best practices for handling streaming errors and preventing client-side API key exposure are correctly documented.
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface Analysis:
- Ingestion points: Untrusted data enters the agent context via input texts in
templates/embeddings.ts(knowledge base construction), image URLs/analysis intemplates/vision-gpt4o.ts, and user messages in various chat completion templates. - Boundary markers: Absent. The templates use standard string interpolation without specific delimiters to isolate external content.
- Capability inventory: The skill has the capability to write files to the local system (
fs.writeFileSyncintemplates/image-generation.ts,templates/audio-transcription.ts, etc.) and execute shell commands (npmcommands inscripts/check-versions.sh). - Sanitization: The skill includes a dedicated moderation template (
templates/moderation.ts) which provides tools for implementing content safety filters.
Audit Metadata