frontpage-million
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes programmatic HTTP requests using
fetchand providescurlexamples to interact with thefrontpage.shAPI for pricing and purchasing grid pixels. - [DATA_EXFILTRATION]: User-provided email addresses are sent to the vendor's servers to facilitate purchase receipts and newsletter enrollment, which is a disclosed and core part of the service's functionality.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it reads user-generated content (labels and URLs) from the public grid.
- Ingestion points: Data is ingested through the
GET /api/million/gridendpoint as described inSKILL.md. - Boundary markers: The instructions do not specify explicit boundary markers or delimiters for the ingested content.
- Capability inventory: The skill can perform network operations via
fetchand authorize financial transactions using the platform's MPP (Machine-to-Machine Payment) SDK. - Sanitization: The service utilizes server-side moderation to filter content, though the skill itself does not specify client-side sanitization of the retrieved grid data.
Audit Metadata