investor-fit-research
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: Communicates with the vendor's official API at api.crawlora.net. This is the intended behavior for fetching investment and company records.
- [COMMAND_EXECUTION]: Uses a bash helper script (scripts/crawlora.sh) to execute curl commands. The script includes robust defensive measures including alphanumeric validation for the API key and a strict whitelist for allowed API paths to prevent unauthorized command execution or route smuggling.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests profile data from external API responses which could contain untrusted instructions. Risk is mitigated by the skill's restricted capabilities (GET only), the hardcoded vendor base URL, and specific instructions for the agent to maintain source attribution and separation of evidence.
Audit Metadata