curviate
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@curviate/clipackage globally via npm to enable its functionality.\n- [COMMAND_EXECUTION]: The skill's primary operation involves executing shell commands through thecurviatebinary.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from LinkedIn, including member profiles, search results, and messages, creating a vulnerability to indirect prompt injection.\n - Ingestion points: LinkedIn profiles, message content, and search results retrieved via the CLI (SKILL.md).\n
- Boundary markers: There are no explicit instructions or delimiters mentioned to prevent the agent from executing instructions potentially hidden in LinkedIn data.\n
- Capability inventory: The agent has the ability to send messages, create posts, and publish jobs, which could be abused if malicious instructions are processed.\n
- Sanitization: The skill does not describe any sanitization or validation of the content retrieved from LinkedIn.
Audit Metadata