frontpage-vote
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install components via
npxfrom the author's GitHub repository (DFectuoso/frontpage-sh-skills). - [COMMAND_EXECUTION]: Utilizes
curlfor fetching data and themppxcommand-line tool for executing blockchain-based payments and API interactions. - [DATA_EXFILTRATION]: Communicates with
https://www.frontpage.shto transmit user interactions like votes, comments, and project ideas. - [PROMPT_INJECTION]: The skill ingests user-generated data (titles, bodies, and comments) from an external API, creating a surface for indirect prompt injection.
- Ingestion points: Fetches data via
GET /api/proposalsandGET /api/proposals/{id}/comments. - Boundary markers: No specific delimiters or warnings for the agent are included for processing the ingested external strings.
- Capability inventory: Possesses network access to the primary API domain via
curlandmppx. - Sanitization: Content submissions are described as being moderated through OpenAI's omni-moderation service.
Audit Metadata