refresh-content

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions to use curl commands via Bash to interact with administrative endpoints (e.g., http://localhost:3000/api/admin/refresh/x-posts). These commands are designed to trigger internal data synchronization processes.
  • [SAFE]: The skill mentions checking environment files (.env.local) for XAI_API_KEY and YOUTUBE_API_KEY. This is documented as a troubleshooting step for administrators to ensure correct configuration and is not an instruction for credential exfiltration.
  • [SAFE]: The skill outlines a data flow involving external content ingestion from X and YouTube. While this presents an indirect injection surface, the skill is focused on the administrative triggering of the sync and mentions existing sanitization logic in the project source code.
  • Ingestion points: External data enters the system from XAI and YouTube APIs.
  • Boundary markers: No specific delimiters or boundary instructions are included in the skill's operational steps.
  • Capability inventory: The skill's environment allows Bash and Read tools.
  • Sanitization: The instructions specifically reference src/lib/xai.ts for handling and sanitizing potentially malformed JSON from external sources.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 11:57 PM
Security Audit — agent-trust-hub — refresh-content