vobiz-partner-api
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill documents the handling of sensitive customer information, including personally identifiable information (PII) and long-lived API authentication tokens (X-Auth-Token). It correctly advises that these tokens should be stored encrypted and never exposed client-side.\n- [INDIRECT_PROMPT_INJECTION]: The skill retrieves data from external API endpoints, such as transaction summaries and KYC metadata, which represent potential surfaces for indirect prompt injection. However, it mitigates risk by recommending server-side confirmation for critical status changes rather than relying on client-side parameters.\n- [COMMAND_EXECUTION]: A Python code snippet is provided to illustrate webhook verification; the snippet uses the standard 'httpx' library and performs benign validation logic.\n- [PROMPT_INJECTION]: The skill includes a 'Complete onboarding recipe' which provides a structured sequence of operations for the agent. These instructions are functional and specific to the API's workflow, without attempting to override system safety guidelines or bypass agent constraints.
Audit Metadata