extension-openai
Fail
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
openai-clientandcaffeineai-authorizationpackages sourced from the Motoko package registry. These dependencies are standard for establishing communication with external AI providers and managing user sessions within the vendor's ecosystem. - [COMMAND_EXECUTION]: Includes a CLI command snippet for installing dependencies via the
mopstool. This is a routine operation for Motoko developers and does not involve piped remote script execution. - [INDIRECT_PROMPT_INJECTION]: The skill enables an interface for processing user-provided prompts via an LLM, creating an inherent surface for indirect injection. 1. Ingestion Point: The
chat(prompt : Text)method inmixins/openai-chat.mo. 2. Boundary Markers: Not explicitly present in the provided templates; the skill relies on application-level logic. 3. Capability Inventory: Includes HTTP outcall capabilities to the OpenAI API for chat and embedding generation. 4. Sanitization: No specific input sanitization or filtering logic is provided in the boilerplate code. - [CREDENTIALS_UNSAFE]: The documentation provides robust guidelines for protecting sensitive OpenAI API keys. It explicitly prohibits creating read endpoints that return the key to the user and mandates the use of non-replicated HTTP outcalls to prevent secrets from being leaked to all nodes during the blockchain consensus process.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata