curviate-quickstart
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@curviate/clipackage from the public npm registry. This is the official command-line tool provided by the skill author to facilitate the intended functionality. - [COMMAND_EXECUTION]: The skill executes various commands using the
curviateCLI for environment setup, authentication, and diagnostics. It explicitly recommends passing sensitive authentication codes via standard input (stdin) rather than command-line flags, preventing the secrets from being exposed in shell history or system process lists. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data by reading LinkedIn profiles through the
curviate profile mecommand. While this constitutes an ingestion point for untrusted content, the risk is mitigated by the skill's design, which is strictly limited to read-only operations and does not perform any automated actions based on the ingested data. - Ingestion points: LinkedIn profile data retrieved via
curviate profile meinSKILL.md. - Boundary markers: None mentioned.
- Capability inventory: CLI commands for reading data and checking account status.
- Sanitization: No specific sanitization or filtering of the retrieved profile content is documented.
Audit Metadata