sendblue-api
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes an integration that ingests data from external sources through webhooks, which creates a potential surface for indirect prompt injection.
- Ingestion points: The skill provides instructions for receiving inbound message payloads via webhooks, which include arbitrary text in the
contentfield and external links in themedia_urlfield (referenced inSKILL.md). - Boundary markers: The provided examples and instructions do not include boundary markers or explicit instructions to ignore potentially malicious content embedded in the incoming message text.
- Capability inventory: The skill enables the agent to send outbound messages, group messages, and reactions, and to manage webhook configurations via API calls (referenced in
SKILL.md). - Sanitization: There are no documented procedures for sanitizing or validating the incoming data from the webhook payloads before it is processed by the agent.
Audit Metadata