unkey
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install
@unkey/apivia npm. This is the official client library for Unkey, a well-known API management service. The reference is documented neutrally as a standard dependency for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The provided authentication middleware processes untrusted data from incoming request headers.
- Ingestion points: The
authMiddlewarefunction inSKILL.mdingests data from theAuthorizationheader of aRequestobject. - Boundary markers: None present; the skill treats the header content as a literal token value.
- Capability inventory: The skill uses the
@unkey/apilibrary to perform network-based key verification. No file system writes, subprocess execution, or shell access capabilities are present in the provided scripts. - Sanitization: The input is extracted from the header and passed directly to the
verifyKeyfunction without additional sanitization or filtering beyond standard string manipulation.
Audit Metadata