plaid-link-setup
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill outlines a workflow that processes external data, specifically public tokens and metadata returned from the Plaid service.
- Ingestion points: The
onSuccesscallback inSKILL.mdreceives tokens and metadata from the client-side Plaid Link component. - Boundary markers: Instructions and code snippets are delimited using standard Markdown formatting.
- Capability inventory: The code templates involve network operations (using
fetchto local API routes) and backend Plaid SDK calls for token exchange. - Sanitization: The skill incorporates explicit security warnings, advising developers to never expose credentials on the client and to encrypt access tokens server-side.
Audit Metadata