curviate-quickstart

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the @curviate/cli package from the public npm registry. This is the official command-line tool provided by the skill author to facilitate the intended functionality.
  • [COMMAND_EXECUTION]: The skill executes various commands using the curviate CLI for environment setup, authentication, and diagnostics. It explicitly recommends passing sensitive authentication codes via standard input (stdin) rather than command-line flags, preventing the secrets from being exposed in shell history or system process lists.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data by reading LinkedIn profiles through the curviate profile me command. While this constitutes an ingestion point for untrusted content, the risk is mitigated by the skill's design, which is strictly limited to read-only operations and does not perform any automated actions based on the ingested data.
  • Ingestion points: LinkedIn profile data retrieved via curviate profile me in SKILL.md.
  • Boundary markers: None mentioned.
  • Capability inventory: CLI commands for reading data and checking account status.
  • Sanitization: No specific sanitization or filtering of the retrieved profile content is documented.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 06:09 PM