skills/acaprino/daodan/domain-hunter/Gen Agent Trust Hub

domain-hunter

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands including curl and whois to check domain availability and interact with the Spaceship registrar API. These operations are essential for the skill's primary function and are performed using standard, non-privileged utilities.
  • [EXTERNAL_DOWNLOADS]: The skill fetches domain-related information from rdap.org and spaceship.dev. These are established and well-known services within the domain industry used for registration data access and API management.
  • [INDIRECT_PROMPT_INJECTION]: The skill is subject to an indirect prompt injection surface because it takes user project descriptions as input to generate domain name suggestions, which are then used in shell commands and Python scripts.
  • Ingestion points: User project descriptions provided during the domain generation step in SKILL.md.
  • Boundary markers: None present in the prompt templates.
  • Capability inventory: Includes shell command execution (curl, whois) and local file execution (python).
  • Sanitization: No explicit sanitization of generated domain names is performed prior to their interpolation into command strings, though the agent's generative step acts as a natural buffer.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:49 PM