primary-logic-external-api
Pass
Audited by Gen Agent Trust Hub on Feb 26, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes external investment data which constitutes an indirect prompt injection surface.
- Ingestion points: Data is ingested from the Primary Logic API via multiple endpoints including
/v1/contentand/v1/tickers/{ticker}/contentas described inSKILL.mdandapi-recipes.md. - Boundary markers: The skill does not define specific delimiters or explicit instructions to ignore embedded commands within the API-returned summaries or snippets.
- Capability inventory: The skill's primary capability is information retrieval and formatting. It has network access to the specified vendor API but lacks high-risk capabilities like writing to the filesystem or executing arbitrary shell commands.
- Sanitization: No explicit sanitization of retrieved API content is mentioned in the logic.
- [EXTERNAL_DOWNLOADS]: The skill communicates with
https://primarylogic--pulse-backend-external-api-app.modal.runfor data retrieval. This domain is a vendor-owned resource hosted on Modal, matching the author 'primary-logic'. References and connectivity tests in the documentation are documented as safe vendor communications. - [COMMAND_EXECUTION]: Documentation files such as
api-recipes.mdandvalidation.mdcontain shell script examples includingcurl,jq, andskills-ref. These are provided as instructional recipes for developers or manual verification and are not part of the agent's autonomous runtime execution.
Audit Metadata