api-campaign-builder
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is authored by the service provider and correctly identifies its primary API endpoint at api.sendx.io. All documented network operations are consistent with the skill's stated purpose.
- [COMMAND_EXECUTION]: Provides template curl commands and a Python example using the requests library for campaign lifecycle management.
- [DATA_EXFILTRATION]: Transmits user-provided content and targeting parameters to the vendor's API. This is the intended behavior and does not target sensitive system or user data.
- [PROMPT_INJECTION]: The skill accepts user-provided HTML for campaign content, which serves as a surface for indirect prompt injection.
- Ingestion points: User-defined HTML body in campaign creation requests (SKILL.md).
- Boundary markers: None identified; user content is interpolated into API call structures.
- Capability inventory: Network requests (POST/GET) via curl and Python requests (SKILL.md).
- Sanitization: None specified; the skill expects the agent to pass user-provided HTML directly to the API.
Audit Metadata