user-research-cookiy
Pass
Audited by Gen Agent Trust Hub on Jun 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a provided shell script,
scripts/cookiy.sh, to interface with the Cookiy AI platform. The script uses standard utilities such ascurlandjqfor networking and data parsing. - [EXTERNAL_DOWNLOADS]: The skill communicates with the vendor's official domains,
cookiy.aiands-api.cookiy.ai, to perform research tasks and retrieve platform updates. - [CREDENTIALS_UNSAFE]: To maintain authentication, the skill stores access tokens in a local file at
~/.cookiy/token.txt. The script enforces restricted file permissions for this file. - [PROMPT_INJECTION]: The automated research synthesis process ingests external interview transcripts, which represent a surface for potential indirect prompt injection. The skill mitigates this through a structured, multi-phase analytical pipeline that focuses the agent on qualitative coding rather than open-ended instruction following.
Audit Metadata