mastodon
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Employs standard CLI utilities including
curl,jq, anduuidgento perform REST API operations and process JSON responses. This usage is consistent with the skill's defined purpose. - [SAFE]: Demonstrates secure practices by utilizing platform-injected credentials ($MASTODON_ACCESS_TOKEN and $MASTODON_BASE_URL) instead of hardcoding sensitive information.
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection. 1. Ingestion points: Data is retrieved from the Mastodon REST API via
curlinSKILL.md(e.g., account verification and status listing). 2. Boundary markers: No explicit delimiters or instructions are provided to ignore embedded content in API responses. 3. Capability inventory: Includes network access (curl) and artifact publishing (publish_artifact). 4. Sanitization: Usesjqto parse structured data, which limits injection to the values of the JSON fields themselves.
Audit Metadata