curviate-search
Warn
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the global installation of the @curviate/cli package from the NPM registry (SKILL.md). This introduces third-party code executed with agent privileges.\n- [COMMAND_EXECUTION]: The skill functions by executing shell commands using the curviate CLI to interact with LinkedIn services (SKILL.md).\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from LinkedIn search results into the agent's context (SKILL.md).\n
- Ingestion points: Results from people, companies, posts, jobs, services, and groups searches in SKILL.md.\n
- Boundary markers: No specific delimiters or safety instructions are defined in SKILL.md to separate ingested data from system prompts.\n
- Capability inventory: Execution of shell commands via curviate CLI in SKILL.md.\n
- Sanitization: The instructions do not specify any validation or sanitization for external content before interpolation.
Audit Metadata