frontpage-million
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill instructions specify network requests to 'https://www.frontpage.sh' for fetching grid data, generating price quotes, and executing purchases. These operations target the vendor's official domain and are required for the skill's documented functionality.
- [COMMAND_EXECUTION]: The documentation provides standard 'curl' and 'npx' command examples for manual testing and installation. These are typical utility commands for developers and do not constitute a security risk in this context.
- [PROMPT_INJECTION]: Ingestion points: The skill retrieves third-party pixel metadata including 'url' and 'label' fields via 'GET /api/million/grid' (SKILL.md). Boundary markers: None observed. Capability inventory: The skill performs network requests (fetch) to the 'frontpage.sh' API. Sanitization: No specific filtering for ingested strings is described. This presents a potential surface for indirect prompt injection, though the impact is low as the agent is instructed to use the data only for coordinate selection.
- [SAFE]: No obfuscation techniques, hardcoded credentials, or persistence mechanisms were detected in the skill content. All payment processes are handled through a dedicated protocol (MPP) meant for machine-to-machine transactions.
Audit Metadata