fabric-api
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes content from the Fabric API, which represents an attack surface for indirect prompt injection if the workspace content contains malicious instructions.
- Ingestion points: Resource data and search results retrieved via the helper scripts from the
https://api.fabric.soendpoints described inSKILL.md. - Boundary markers: The skill does not explicitly instruct the agent to use delimiters or ignore instructions within the retrieved content.
- Capability inventory: The agent can perform network requests and read files using the provided helper scripts (
scripts/fabric.mjs,scripts/fabric.py). - Sanitization: The utility scripts pass API responses directly to the agent without filtering or sanitizing the content.
Audit Metadata