shared-forest-sponsor
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill interacts with the external domain
sharedforest.comvia API calls to manage tree sponsorships, retrieve pricing, and create designs. These network operations are essential to the skill's functionality but target a non-whitelisted domain. - [COMMAND_EXECUTION]: The documentation includes
curlcommand examples to demonstrate how to interact with the API, which involve shell execution for HTTP requests and the generation of idempotency keys. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted user input (wishes, display names) and external data from API responses. Risk is mitigated by instructions to confirm details with the human user, providing manual confirmation links, and utilizing server-side content reviews.
Audit Metadata