one-connect
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the official
@withone/connectpackage from the NPM registry. - [COMMAND_EXECUTION]: Provides standard instructions for dependency management using
npm installfor vendor-specific libraries. - [DATA_EXFILTRATION]: Documents an OAuth 2.1 flow communicating with the vendor's official domains (
api.withone.ai,mcp.withone.ai). These are legitimate service endpoints for the application's intended purpose. - [INDIRECT_PROMPT_INJECTION]: The guide describes routes that ingest external data via OAuth callback parameters. It includes robust security mitigations, such as mandatory CSRF state validation and PKCE (Proof Key for Code Exchange), to ensure the integrity of the data exchange.
Audit Metadata