award-calendar
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to
https://seats.aero/partnerapi/searchto retrieve flight availability data. This targets a well-known service related to the skill's primary purpose. - [COMMAND_EXECUTION]: Instructs the agent to execute
curlcommands to interact with the Seats.aero API. The commands use an environment variable ($SEATS_AERO_API_KEY) for authentication, following secure practices by avoiding hardcoded credentials. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data originating from the Seats.aero API.
- Ingestion points: The JSON response body from the
seats.aerosearch endpoint. - Boundary markers: Not explicitly implemented in the instructions.
- Capability inventory: Includes network access via
curland markdown formatting for display. - Sanitization: The instructions rely on the structured nature of the flight data API to minimize risks.
Audit Metadata