http-api-cloudbase
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides documentation and implementation guidelines for official Tencent CloudBase HTTP APIs. All referenced domains (e.g., tcloudbasegateway.com) and resource identifiers belong to the official vendor infrastructure. The instructions emphasize secure practices, such as warning against using API keys in client-side code and recommending Phone SMS verification as a secure default.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest OpenAPI specifications using the
searchKnowledgeBasetool to guide code generation. - Ingestion points: The
searchKnowledgeBase({ mode: "openapi", apiName: "..." })tool call is used inSKILL.mdandreferences/extended-guide.mdto fetch definitions for services likemysqldb,nosql, andauth. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands within the tool output are provided.
- Capability inventory: The skill uses the ingested data to generate
curlcommands and HTTP request logic for various runtimes. It does not instruct the agent to automatically execute these commands or perform network operations based on the tool output. - Sanitization: No specific sanitization or validation of the YAML content returned by the knowledge base is described.
Audit Metadata