curviate-inbox
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@curviate/clipackage globally via npm to enable its functionality, which is a vendor-provided tool required for the skill's operation. - [COMMAND_EXECUTION]: The skill relies on executing shell commands through the
curviateCLI for all LinkedIn interactions, including message retrieval, sending, and webhook management. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill retrieves external data from LinkedIn via
inbox messages,inbox get, andinbox listas described inSKILL.md. - Boundary markers: There are no explicit instructions or delimiters defined to help the agent isolate retrieved message content from its primary instructions or to warn against executing instructions contained within those messages.
- Capability inventory: The skill enables the agent to perform high-impact actions such as sending messages, InMails, and managing webhooks (
message send,message inmail,webhook create). - Sanitization: The skill lacks specified sanitization or filtering logic for external data before it is presented to the agent's context.
Audit Metadata