conversations
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to api.zavu.dev to retrieve and manage messaging data. This is a functional requirement and targets the vendor's official domain.
- [CREDENTIALS_UNSAFE]: The documentation demonstrates the use of environment variables (e.g., $ZAVUDEV_API_KEY) for storing API keys, which is the recommended secure practice to avoid hardcoded credentials.
- [PROMPT_INJECTION]: The skill processes external message data, which represents an indirect prompt injection surface. Ingestion points: Message text from /v1/messages and thread data from /v1/conversations. Boundary markers: Absent. Capability inventory: Network requests via fetch to api.zavu.dev. Sanitization: Absent. While the surface exists, no malicious instructions or vulnerabilities are present in the skill code itself.
Audit Metadata