domain-hunter
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands including
curlandwhoisto check domain availability and interact with the Spaceship registrar API. These operations are essential for the skill's primary function and are performed using standard, non-privileged utilities. - [EXTERNAL_DOWNLOADS]: The skill fetches domain-related information from
rdap.organdspaceship.dev. These are established and well-known services within the domain industry used for registration data access and API management. - [INDIRECT_PROMPT_INJECTION]: The skill is subject to an indirect prompt injection surface because it takes user project descriptions as input to generate domain name suggestions, which are then used in shell commands and Python scripts.
- Ingestion points: User project descriptions provided during the domain generation step in
SKILL.md. - Boundary markers: None present in the prompt templates.
- Capability inventory: Includes shell command execution (
curl,whois) and local file execution (python). - Sanitization: No explicit sanitization of generated domain names is performed prior to their interpolation into command strings, though the agent's generative step acts as a natural buffer.
Audit Metadata