cloudbeds-api
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and provides URLs to official Cloudbeds developer resources, including OpenAPI specifications, SDKs, and documentation hosted on GitHub and the official developer portal. Examples include
github.com/cloudbeds/openapi-specs,github.com/cloudbeds/cloudbeds-api-python, anddevelopers.cloudbeds.com. The documentation also suggests using thewebhook.siteservice for testing webhook payloads during development.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes a process where the agent ingests data from external sources, specifically reservation details and webhook payloads containing user-supplied content like notes or guest names. This data is then used in logic for subsequent API interactions.\n - Ingestion points: Untrusted data enters the context via webhook JSON payloads (
references/webhooks.md) and API responses from endpoints such asgetReservation(SKILL.md).\n - Boundary markers: The instructions do not explicitly define delimiters for variable interpolation in prompts.\n
- Capability inventory: The skill enables the agent to interact with the Cloudbeds API to perform actions such as creating reservations, processing payments, and updating guest profiles.\n
- Sanitization: While the skill emphasizes data integrity for financial values, it does not specify sanitization methods for prompt interpolation of strings from the API.\n- [NO_CODE]: This skill consists entirely of markdown documentation and reference material without providing custom scripts or executable binaries.
Audit Metadata