trustlayer-sybil-scanner
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches agent reputation, Sybil risk, and historical data from the TrustLayer API (
api.thetrustlayer.xyz). These are data-only requests used to inform the agent's decision-making process. - [COMMAND_EXECUTION]: The skill uses
curlto interact with the service endpoints. The output is processed using standard utilities likegrep,cut, andjqfor field extraction, rather than being piped directly to a command interpreter. - [PROMPT_INJECTION]: The skill is designed to ingest and act upon data from an external API, creating a surface for indirect prompt injection.
- Ingestion points: Data enters the agent context via
curlrequests to the TrustLayer API (e.g.,/trust,/agent,/reviewerendpoints). - Boundary markers: None explicitly defined to separate external data from agent instructions.
- Capability inventory: The skill uses
curlto perform network operations but does not show evidence of file-writing or subprocess execution beyond data retrieval. - Sanitization: The skill uses targeted extraction (
grep,cut) to isolate specific JSON fields (e.g.,sybil_risk,trust_score), which limits the impact of arbitrary content in other fields.
Audit Metadata