adapty-docs

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch documentation indices and articles from the vendor's official domains (adapty.io, swift.adapty.io, android.adapty.io, etc.) and well-known services like pub.dev.
  • [COMMAND_EXECUTION]: The skill provides a shell command example using curl and awk to search through large documentation aggregates and mentions using openssl to generate a random 8-character session token for analytics tracking.
  • [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves ingesting untrusted content from external documentation pages, which presents a surface for indirect instructions.
  • Ingestion points: Documentation content retrieved from https://adapty.io/docs/<slug>.md and aggregated text files.
  • Boundary markers: None identified; the skill does not specify delimiters or instructions to ignore embedded prompts in the fetched documentation.
  • Capability inventory: The skill utilizes shell commands (curl, awk, openssl) and network access to retrieve and process external data.
  • Sanitization: No evidence of sanitization or validation of the external documentation content is present.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 02:30 PM
Security Audit — agent-trust-hub — adapty-docs