capigo-api
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official installation sources for the
capigoCLI, including GitHub (github.com/vtech-com/capigo-api-sdk) and Homebrew. These resources originate from the vendor's own infrastructure and are necessary for the skill's stated purpose. - [COMMAND_EXECUTION]: The skill's primary function is to execute the
capigobinary. It implements a discovery-based workflow using the CLI's internal help system (capigo <group> <command> --help) to ensure the agent uses valid and supported flags for the specific version installed on the machine. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from a CLI tool that communicates with a remote API, creating a theoretical attack surface for indirect prompt injection. However, the instructions strongly mitigate this by mandating that the agent parse stdout as structured JSON and verify
.errorkeys before processing.data, which prevents the agent from being misled by unstructured text output.
Audit Metadata