frontpage-million

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes programmatic HTTP requests using fetch and provides curl examples to interact with the frontpage.sh API for pricing and purchasing grid pixels.
  • [DATA_EXFILTRATION]: User-provided email addresses are sent to the vendor's servers to facilitate purchase receipts and newsletter enrollment, which is a disclosed and core part of the service's functionality.
  • [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it reads user-generated content (labels and URLs) from the public grid.
  • Ingestion points: Data is ingested through the GET /api/million/grid endpoint as described in SKILL.md.
  • Boundary markers: The instructions do not specify explicit boundary markers or delimiters for the ingested content.
  • Capability inventory: The skill can perform network operations via fetch and authorize financial transactions using the platform's MPP (Machine-to-Machine Payment) SDK.
  • Sanitization: The service utilizes server-side moderation to filter content, though the skill itself does not specify client-side sanitization of the retrieved grid data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 02:50 AM
Security Audit — agent-trust-hub — frontpage-million