agent-api-integration-specialist
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to handle external data from third-party APIs and webhooks, which are untrusted ingestion points.
- Ingestion points: Processes external data from webhooks, API responses, and OAuth flows as described in the 'Capabilities' section.
- Boundary markers: The skill mentions 'Payload validation and schema verification' as a capability to ensure data integrity, but it does not specify explicit delimiters to prevent the agent from interpreting embedded instructions within these payloads as its own commands.
- Capability inventory: The agent is tasked with creating API client libraries and webhook handlers, which involves executing network operations and writing code based on external specifications.
- Sanitization: The instructions include 'Sensitive data redaction' and 'Signature verification' (HMAC-SHA256, etc.), which are effective for security and privacy but do not specifically address prompt injection risks from the content of the external data.
Audit Metadata