curviate-engage

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to install and use the @curviate/cli command-line tool. This includes commands for authentication, account management, and interacting with LinkedIn data.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the @curviate/cli package via npm (npm install -g @curviate/cli). This is a tool provided by the skill author for interacting with their service.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection due to its core functionality.
  • Ingestion points: The skill reads untrusted external data through commands like curviate feed home, curviate notification list, curviate post reactions, and curviate comment list (SKILL.md).
  • Boundary markers: There are no instructions for the agent to use delimiters or ignore embedded instructions when processing content fetched from LinkedIn.
  • Capability inventory: The skill provides write capabilities including curviate post create, curviate comment add, curviate post react, and curviate post delete (SKILL.md).
  • Sanitization: No specific sanitization or filtering logic is provided for the external content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 06:06 PM