alterlab-yok-akademik
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill communicates exclusively with the official Turkish government academic portal (akademik.yok.gov.tr). These network operations are necessary for the skill's documented purpose and target a trusted, well-known government resource.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute a local Python helper script (scripts/yok_akademik.py) which handles the scraping logic. This is a standard and safe implementation for processing complex HTML responses.
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface because it processes untrusted HTML data from external web pages. However, this is well-mitigated: 1. Ingestion points: The script fetches content from the YOK Akademik portal. 2. Boundary markers: The SKILL.md file includes clear instructions for the agent to verify candidate matches with the user and never invent profiles. 3. Capability inventory: The skill utilizes Bash and WebFetch. 4. Sanitization: The Python script uses BeautifulSoup to extract only visible text and explicitly strips HTML tags, significantly reducing the risk of malicious payloads affecting the agent context.
Audit Metadata