a1-yandex-kit-catalog
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides Node.js scripts (search_docs.mjs and validate.mjs) for local documentation search and validation. These scripts use only built-in Node.js modules (fs, url, zlib) and do not require external package installation or network access.- [DATA_EXFILTRATION]: The skill communicates with the Yandex KIT API at api.kit.yandex.net. Instructions specify that authentication tokens should be provided via the YANDEX_KIT_TOKEN environment variable, following standard secret management practices.- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses, which the agent then processes to manage the product catalog.
- Ingestion points: API response bodies from GetProducts, GetVariants, GetCategories, and related endpoints.
- Boundary markers: None identified in the instructional text for separating API content from system prompts.
- Capability inventory: Catalog management operations (create/update/delete) and network request capabilities via the Yandex KIT API.
- Sanitization: No specific sanitization or filtering of API data is performed within the provided skill instructions.
Audit Metadata