remix-api-reference
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a remote OpenAPI JSON specification from
https://api.remix.gg/docs/jsonto define API contracts and schemas at runtime.- [DATA_EXFILTRATION]: The skill performs network operations tohttps://api.remix.ggfor tasks such as game creation, asset uploads, and analytics retrieval. These operations use a bearer token for authentication.- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to the ingestion and processing of external data that influences agent behavior. - Ingestion points: OpenAPI specification fetched from
https://api.remix.gg/docs/json(SKILL.md). - Boundary markers: Absent; the instructions tell the agent to use the external JSON as the "contract source of truth" without requiring delimiters or validation.
- Capability inventory: Network requests (GET/POST/DELETE) to
https://api.remix.ggand file uploads viaPOST /v1/games/{gameId}/assets. - Sanitization: Absent; there is no instruction for the agent to validate the structure or content of the remote schema before usage.
Audit Metadata