waveinflu-lookup-creator-email
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strict input validation and canonicalization for URLs in scripts/lookup.mjs, protecting against malformed inputs and ensuring requests are only made for supported platforms.
- [SAFE]: Credential management follows security best practices by loading the API key from protected local configuration directories (e.g., ~/.config/waveinflu/) and explicitly instructing the agent never to request or display the key in the chat interface.
- [SAFE]: The skill uses a bounded orchestration model in scripts/lookup-batch.mjs, limiting concurrency to three items and implementing quota guards to prevent accidental over-usage.
- [SAFE]: The skill includes specific defensive instructions in SKILL.md to mitigate indirect prompt injection by marking all external API data as untrusted and prohibiting the agent from following any embedded instructions.
Audit Metadata