one-connect
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is primarily instructional documentation for integrating the official '@withone/connect' SDK. It follows security best practices by explicitly advising the use of environment variables for secrets and warning against hardcoding credentials in source code or sharing them in chat prompts.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the vendor-owned package '@withone/connect' via npm and the use of the 'one' CLI tool. These are standard development practices for this service and originate from the skill's authoring organization.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of data from external platforms (e.g., Gmail, Slack) via the 'One Connect' API. While this represents an inherent attack surface where external content could contain malicious instructions, the skill instructions are focused on functional integration and do not contain or encourage unsafe interpolation of untrusted data.
Audit Metadata