Truto Link SDK
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the
@truto/truto-link-sdkpackage via npm. This is a legitimate library provided by the vendor (Truto) for its integration platform. - [INDIRECT_PROMPT_INJECTION]: The SDK documentation describes functions that ingest external data, such as link tokens, integrated account tokens, and JSONata expressions (
trutoExpression) for data transformation. These represent standard data ingestion surfaces for a developer-oriented SDK and are not used for executing unauthorized commands within the agent context. - [SAFE]: The skill explicitly promotes secure coding practices by instructing users to keep their
TRUTO_API_TOKENon the backend and only expose ephemeral, low-privilege link tokens to the browser client.
Audit Metadata