curviate-inbox

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the @curviate/cli package globally via npm to enable its functionality, which is a vendor-provided tool required for the skill's operation.
  • [COMMAND_EXECUTION]: The skill relies on executing shell commands through the curviate CLI for all LinkedIn interactions, including message retrieval, sending, and webhook management.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill retrieves external data from LinkedIn via inbox messages, inbox get, and inbox list as described in SKILL.md.
  • Boundary markers: There are no explicit instructions or delimiters defined to help the agent isolate retrieved message content from its primary instructions or to warn against executing instructions contained within those messages.
  • Capability inventory: The skill enables the agent to perform high-impact actions such as sending messages, InMails, and managing webhooks (message send, message inmail, webhook create).
  • Sanitization: The skill lacks specified sanitization or filtering logic for external data before it is presented to the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 06:07 PM