managing-statuspal
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local bash scripts to interact with the Statuspal API. These scripts utilize common system utilities such as
curlfor network communication,jqfor parsing structured JSON data, andcolumnfor output formatting. These operations are consistent with the skill's stated purpose. - [EXTERNAL_DOWNLOADS]: The skill communicates with
https://statuspal.io/api/v2, which is the official API endpoint for the Statuspal service. These network operations are necessary for status page management and do not involve untrusted or suspicious domains. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external API, which constitutes an attack surface for indirect prompt injection. A malicious actor with control over the status page content (e.g., incident descriptions) could attempt to embed instructions to influence the agent. The skill mitigates this risk by using
jqto extract only specific, expected data fields rather than processing raw, unstructured text in its entirety.
Audit Metadata