setup-api-key
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate instructions for setting up the Sonilo API and CLI tools using standard configuration methods.
- [EXTERNAL_DOWNLOADS]: References official packages (
sonilo-cli,sonilo) and repositories (github.com/sonilo-ai/skills) which are associated with the verified author. - [SAFE]: Includes explicit safety rules instructing the agent to never leak or echo user API keys or credentials in chat logs.
- [INDIRECT_PROMPT_INJECTION]: The skill manages a configuration flow where users provide API keys. This potential attack surface is addressed through instructions that prioritize secure local configuration (e.g.,
claude mcp add) over sharing keys in prompt history. - Ingestion points: User provides an API key during the setup process described in SKILL.md.
- Boundary markers: Explicit instruction for the agent to tell the user not to paste the key directly into chat and to use specific commands instead.
- Capability inventory: Capability to configure MCP servers and execute CLI account checks as described in SKILL.md.
- Sanitization: Recommendations for secure environment-based configuration rather than direct string interpolation of credentials.
Audit Metadata