social-campaigns
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses curl to perform HTTP requests to an external API defined by the LAYERPROOF_BASE_URL environment variable. These commands allow the agent to send data to and receive data from an external service.
- [PROMPT_INJECTION]: The skill processes data from external API responses, such as campaign details and social media captions, which constitutes an indirect prompt injection surface.
- Ingestion points: Data is retrieved from GET requests to the social-campaigns API (PublicApiCampaignResponse, PublicApiPostSummary).
- Boundary markers: No specific delimiters or instructions are used to isolate or ignore potential instructions embedded in the API data.
- Capability inventory: The agent can execute shell commands via curl and handle file exports (ZIP files).
- Sanitization: There is no evidence of sanitization or validation of the text content returned by the API before processing.
Audit Metadata