domain
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted user data which is subsequently used in high-capability tools. * Ingestion points: Candidate domain names and search phrases provided by the user in SKILL.md. * Boundary markers: Absent; inputs are interpolated directly into shell and browser commands. * Capability inventory: Network requests via curl, browser automation via agent-browser, and domain purchasing via vercel CLI. * Sanitization: None; the skill does not explicitly validate or escape user-provided strings before use.
- [COMMAND_EXECUTION]: The skill relies on shell command execution for its primary functionality, including calls to the vercel CLI, whois, and curl for API interactions.
- [EXTERNAL_DOWNLOADS]: The instructions suggest installing the vercel CLI from NPM and whois from Homebrew, which are well-known and trusted sources.
Audit Metadata