soul-builder
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data fetched from external accounts and websites, creating an exposure to indirect prompt injection. \n
- Ingestion points: Data is pulled from the X.AI Responses API and external URLs via WebFetch and WebSearch (SKILL.md). \n
- Boundary markers: The skill relies on natural language instructions for the agent to distinguish between analysis material and executable instructions. \n
- Capability inventory: Includes file system writing (contents:write), network operations (secretcurl), and notification delivery. \n
- Sanitization: Instructions explicitly command the agent to discard directives like "ignore your instructions" or "you are now..." and log warnings when they are encountered. \n- [EXTERNAL_DOWNLOADS]: The skill communicates with the X.AI API (api.x.ai) to retrieve post history. This is a legitimate interaction with a well-known service necessary for the skill's primary purpose. \n- [COMMAND_EXECUTION]: The skill executes shell commands using jq and curl. It employs security best practices by using jq's --arg for variable interpolation and a specialized ./secretcurl wrapper to prevent credential exposure in shell history. \n- [PROMPT_INJECTION]: Static analysis flags phrases like "ignore your instructions" which are present in the text. However, these are instructions to the agent to discard such directives found in untrusted content, serving as a safety filter rather than a malicious injection.
Audit Metadata