curviate-engage
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to install and use the
@curviate/clicommand-line tool. This includes commands for authentication, account management, and interacting with LinkedIn data. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@curviate/clipackage via npm (npm install -g @curviate/cli). This is a tool provided by the skill author for interacting with their service. - [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection due to its core functionality.
- Ingestion points: The skill reads untrusted external data through commands like
curviate feed home,curviate notification list,curviate post reactions, andcurviate comment list(SKILL.md). - Boundary markers: There are no instructions for the agent to use delimiters or ignore embedded instructions when processing content fetched from LinkedIn.
- Capability inventory: The skill provides write capabilities including
curviate post create,curviate comment add,curviate post react, andcurviate post delete(SKILL.md). - Sanitization: No specific sanitization or filtering logic is provided for the external content before it is processed by the agent.
Audit Metadata