sent-integration-starter
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a developer integration guide for the Sent v3 API. It adheres to security industry standards by advising against hardcoding credentials and promoting the use of HMAC-SHA256 for webhook verification.
- [COMMAND_EXECUTION]: The skill includes a Python utility (
scripts/preflight.py) for local validation of integration payloads. Analysis of the source code confirms it is a benign static analysis tool that does not perform network operations, sensitive file access, or dynamic code execution. - [EXTERNAL_DOWNLOADS]: The documentation references official SDKs for TypeScript, Python, Go, Java, C#, PHP, and Ruby. These packages (@sentdm/sentdm, sentdm, etc.) are official vendor resources hosted on standard public registries and align with the author's verified identity.
- [INDIRECT_PROMPT_INJECTION]: The preflight script ingests JSON data from external files. While this creates a data ingestion surface, the script lacks dangerous capabilities such as shell execution or file-system modifications, rendering the surface safe for use in an agentic workflow.
Audit Metadata