sendblue-api
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted data through inbound webhooks (documented in Step 4 and Example 4).
- Ingestion points: Inbound message 'content' field processed via HTTP POST webhooks in SKILL.md.
- Boundary markers: None explicitly mentioned for the message body content to separate it from instructions.
- Capability inventory: The skill is designed to guide the creation of application code for sending messages, creating groups, and managing contacts.
- Sanitization: The documentation recommends using HTTPS, verified authentication/signatures, and replay protection for webhook endpoints.
- [DATA_EXPOSURE]: The skill documentation describes the use of sensitive API credentials (sb-api-key-id and sb-api-secret-key).
- It correctly identifies these as server-side secrets and warns against exposing them in client-side code, logs, or agent output.
- It recommends using environment variables ($KEY_ID, $SECRET) for authentication and suggests key rotation if values are exposed.
Audit Metadata