authentication
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
curlcommands to interact with API endpoints for authentication and data management. - [DATA_EXFILTRATION]: The skill facilitates the transmission of sensitive user credentials, including emails, passwords, and tokens, to the official Spuree domains (studio.spuree.com and data.spuree.com). This behavior is the primary intended function of the skill and is required for API access.
- [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: User-provided email, password, and authorization codes (SKILL.md). 2. Boundary markers: Absent; credentials and codes are interpolated directly into shell commands (SKILL.md). 3. Capability inventory: Uses
curlfor network requests and can open a local listener for SSO callbacks (SKILL.md). 4. Sanitization: Absent; no validation of user-provided authentication strings is described (SKILL.md).
Audit Metadata