company-name-generator
Warn
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
SKILL.mdfile instructs the agent to execute thewhoissystem utility to verify domain availability. Direct execution of shell commands based on generated strings poses a potential risk of command injection. - [COMMAND_EXECUTION]: The skill instructs the agent to run a shell script located at
scripts/check-domains.shwith generated name arguments. As this script was not provided in the skill package, its specific implementation cannot be audited for security. - [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests untrusted data from web search results when checking for trademark conflicts and social media handle availability.
- Ingestion points: WebSearch results for trademark filings, app store presence, and social media account details.
- Boundary markers: Absent. There are no instructions for the agent to use delimiters or ignore embedded instructions within search results.
- Capability inventory: Subprocess execution (
whois,scripts/check-domains.sh), and outbound network requests (WebFetch,WebSearch). - Sanitization: Absent. The instructions do not specify any validation or filtering of external content before the agent processes it.
Audit Metadata