short-url
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The documentation includes a
curlcommand example to demonstrate API usage. This is a standard instructional pattern for developers. \n- [EXTERNAL_DOWNLOADS]: The skill mentions themcp-shorturlpackage for installation viapip. This package belongs to the vendor's ecosystem and is a standard requirement for the described tool-use functionality. \n- [INDIRECT_PROMPT_INJECTION]: \n - Ingestion points: The
contentfield in API requests accepts arbitrary long URLs from external sources or user input (SKILL.md). \n - Boundary markers: Absent in the provided prompt structure. \n
- Capability inventory: Performs network operations via
curlto the vendor-ownedapi.acedata.cloudendpoint (SKILL.md). \n - Sanitization: The skill documentation specifies that inputs must be valid URLs.
Audit Metadata