apideck-rest
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONOBFUSCATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides standard curl command examples for interacting with the Apideck API using the vendor's official domain (unify.apideck.com).
- [OBFUSCATION]: Base64 encoded strings are used in API response examples to demonstrate pagination cursors. Decoding confirmed these are benign strings (e.g., 'zoho-crm::offset::0') used for tracking page positions and not for hiding malicious commands.
- [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for fetching and processing data from external third-party services (CRM, HRIS, etc.), creating a surface for potential injection from those external sources.
- Ingestion points: API responses from unify.apideck.com representing data from connected third-party platforms.
- Boundary markers: None specified in the instructions to delimit or ignore instructions within the ingested external data.
- Capability inventory: The documentation suggests using curl for HTTP operations, which represents a command execution capability.
- Sanitization: The documentation does not include explicit instructions for sanitizing, validating, or escaping external data before processing.
Audit Metadata