api-rate-limit-handler
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements logic to parse and act upon untrusted data from external API response headers, specifically
Retry-Afterandx-ratelimit-resetheaders. - Ingestion points: API response headers are read in the
get_retry_delay(TypeScript) andfetch_with_retry(Python) functions withinSKILL.md. - Boundary markers: The skill does not explicitly use delimiters for these inputs, but it performs type validation and range checking.
- Capability inventory: The skill uses the
fetchAPI (TypeScript) andhttpx(Python) to perform network requests. - Sanitization: The implementation includes safeguards such as
Number.isFiniteandmaxDelayMs/maxElapsedMscaps to prevent extremely long delays or overflows that could be induced by malicious headers.
Audit Metadata