adapty-docs
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch documentation indices and articles from the vendor's official domains (
adapty.io,swift.adapty.io,android.adapty.io, etc.) and well-known services likepub.dev. - [COMMAND_EXECUTION]: The skill provides a shell command example using
curlandawkto search through large documentation aggregates and mentions usingopensslto generate a random 8-character session token for analytics tracking. - [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves ingesting untrusted content from external documentation pages, which presents a surface for indirect instructions.
- Ingestion points: Documentation content retrieved from
https://adapty.io/docs/<slug>.mdand aggregated text files. - Boundary markers: None identified; the skill does not specify delimiters or instructions to ignore embedded prompts in the fetched documentation.
- Capability inventory: The skill utilizes shell commands (
curl,awk,openssl) and network access to retrieve and process external data. - Sanitization: No evidence of sanitization or validation of the external documentation content is present.
Audit Metadata